Съмнение за зараза - Компютъра работи по-бавно от преди, мишката премигва. - Премахване на зловреден софтуер - Kaldata.com

20 август 202520 Авг

Често ми се случва мишката да ми премигва, работата на компютъра да е бавна.
Използвам SSD, а характеристиките му са: Ryzen 5600H, RX6600M, 16 GB RAM.

Гледам филми интернет във различни сайтове, ползвам го за игри, но дори и леките игри имат спад във FPS-a, накъсвания все едно съм със 30-45 фпс. (WoW WoTLK показва 100 фпс,а усещането е 45-50.) Според AMD софтуера видео драйвърите са ъпдейтнати.
Преинсталация не съм му направил, но обмислям да го върна във фабрични настройки от опцията на уиндоуса, но все забравям да си купя някоя флашка във която да кача снимки и нужни файлове, но преди фабричните настройки бихте ли погледнали данните от сканирането на програмата?

Пускам логовете.

Благодаря за отделеното време!

FRST.txt Addition.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

20 август 202520 Авг

Здравейте..! Тези папки познати ли ви са:

C:\WINDOWS\system32\ddsStjrcte
C:\WINDOWS\system32\vmbusLuusiwwcarwy
C:\WINDOWS\system32\UvvWhvlnbymdemqan
C:\WINDOWS\system32\HidWzzyuuxkbmx
C:\WINDOWS\system32\BillQkvdyflbka

Farbar Recovery Scan Tool SearchAll

Щракнете с десния бутон върху FRST и изберете Run as administrator
Копирайте/поставете следното в полето Search:

SearchAll: Bitdefender;Kaspersky;Avast

Щракнете върху Search Files
Когато приключите, щракнете върху OK и на вашия работен плот ще се отвори Search.txt ..Моля прикачете го в следващия си пост.

1

20 август 202520 Авг

Автор

преди 24 минути, icotonev написа:

C:\WINDOWS\system32\ddsStjrcte
C:\WINDOWS\system32\vmbusLuusiwwcarwy
C:\WINDOWS\system32\UvvWhvlnbymdemqan
C:\WINDOWS\system32\HidWzzyuuxkbmx
C:\WINDOWS\system32\BillQkvdyflbka

Проверих няма папки, а файлове. Не са ми познати, но и не влизам във System32.
Ако кажете да ги изтрия ще го направя!

Search.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

20 август 202520 Авг

преди 13 минути, - Factory. написа:

Ако кажете да ги изтрия ще го направя!

Не аз ще ги включа във фикс и ще ги премахна ..! Но какво правим с остатъците от три антивирусни програми (погледни Search.txt файла) ...В момента системата ви се задъхва защото вероятно всички тези остатъци влизат в конфликт..! Мога да ги включа във фикс но ще се забавя много..!

1

20 август 202520 Авг

Автор

преди 13 минути, icotonev написа:

Не аз ще ги включа във фикс и ще ги премахна ..! Но какво правим с остатъците от три антивирусни програми (погледни Search.txt файла) ...В момента системата ви влиза се задъхва защото вероятно всички тези остатъци влизат в конфликт..! Мога да ги включа във фикс но ще де забавя много..!

Антивирусните ги ползвах просто за сканиране и след това ги изтрих явно беше грешка която не знаех.
Иначе няма проблем по-добре е да те изчакам отколкото да изтрия нещо което не трябва, защото имаме със жена ми и много документи.

1

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

20 август 202520 Авг

Фикс с Farbar Recovery Scan Tool

Щракнете с десния бутон върху иконата FRST и изберете Изпълнете като администратор
Маркирайте информацията от карето по долу , след което натиснете клавишите Ctrl + C едновременно и текстът ще бъде копиран
Няма нужда да поставяте информацията , FRST ще я направи вместо вас.

Start::
CreateRestorePoint:
CloseProcesses:

HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKU\S-1-5-21-2794772896-3456025328-3779792213-1001\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {0495E6D1-B695-4924-A772-533FD69422D3} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe  (No File)
Task: {FDF1C291-1E8F-4490-A2A1-36136216F70E} - System32\Tasks\EOSv3 Scheduler onLogOn => C:\Users\49176\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScanner.exe  LOGON (No File)
Task: {59FAF378-D4D8-4A17-806B-01D7E47D2DA4} - System32\Tasks\EOSv3 Scheduler onTime => C:\Users\49176\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScanner.exe  SCHED (No File)
Task: {02AC8D03-28C0-4B46-AB36-3AD0C8F3F705} - System32\Tasks\Lenovo\Vantage\Schedule\NotificationCenter => C:\Program Files (x86)\Lenovo\VantageService\3.13.72.0\ScheduleEventAction.exe  NotificationCenter (No File)
Task: {0EAD228D-DF72-45D0-A320-F1DB01E4451F} - System32\Tasks\Lenovo\Vantage\StartupFixPlan => C:\Program Files (x86)\Lenovo\VantageService\4.2.24.0\\uninstall.exe  /repair (No File)
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
Folder: C:\WINDOWS\system32\ddsStjrcte
Folder: C:\WINDOWS\system32\vmbusLuusiwwcarwy
Folder: C:\WINDOWS\system32\UvvWhvlnbymdemqan
Folder: C:\WINDOWS\system32\HidWzzyuuxkbmx
Folder: C:\WINDOWS\system32\BillQkvdyflbka
File: C:\WINDOWS\system32\ddsStjrcte
File: C:\WINDOWS\system32\vmbusLuusiwwcarwy
File: C:\WINDOWS\system32\UvvWhvlnbymdemqan
File: C:\WINDOWS\system32\HidWzzyuuxkbmx
File: C:\WINDOWS\system32\BillQkvdyflbka
C:\Windows.old\WINDOWS\System32\winevt\Logs\Kaspersky Event Log.evtx
C:\Windows\System32\winevt\Logs\Kaspersky Event Log.evtx
C:\Users\49176\Downloads\bitdefender_avfree.exe
C:\Users\49176\Desktop\Photos\Bitdefender.lnk
C:\Windows.old\WINDOWS\Temp\_avast_
C:\Windows.old\Users\49176\AppData\Local\Packages\Kaspersky.ShellEx16_b81m8cbssw9gt
C:\Windows.old\Users\49176\AppData\Local\Packages\Kaspersky.ShellEx_b81m8cbssw9gt
C:\Users\49176\AppData\Roaming\Avast Software
C:\Users\49176\AppData\Roaming\Bitdefender Security App
C:\Users\49176\AppData\Roaming\Avast Software\Avast
C:\Users\49176\AppData\Roaming\Avast Software\Avast\Cache\IndexedDB\https_checkout.avast.com_0.indexeddb.leveldb
C:\Users\49176\AppData\Local\Avast Software
C:\Users\49176\AppData\Local\Bitdefender
C:\Users\49176\AppData\Local\Packages\Kaspersky.ShellEx16_b81m8cbssw9gt
C:\Users\49176\AppData\Local\Packages\Kaspersky.ShellEx_b81m8cbssw9gt
C:\Users\49176\AppData\Local\Avast Software\Avast
C:\ProgramData\Avast Software
C:\ProgramData\Bitdefender
C:\ProgramData\Bitdefender Agent
C:\ProgramData\Kaspersky Lab
C:\ProgramData\Kaspersky Lab Setup Files
C:\ProgramData\Packages\Kaspersky.ShellEx16_b81m8cbssw9gt
C:\ProgramData\Packages\Kaspersky.ShellEx_b81m8cbssw9gt
C:\ProgramData\Bitdefender\Bitdefender Safepay
C:\ProgramData\Bitdefender\Bitdefender Security App
C:\Program Files (x86)\Common Files\Kaspersky Lab
C:\Program Files\Common Files\Bitdefender
AV: Kaspersky (Disabled - Up to date) {4F76F112-43EB-40E8-11D8-F7BD1853EA23}
AlternateDataStreams: C:\Users\49176\Downloads\DiscordSetup.exe:MBAM.Zone.Identifier [50]
AlternateDataStreams: C:\Users\49176\Downloads\MP3StudioDownloader_3_1_2.exe:MBAM.Zone.Identifier [50]
AlternateDataStreams: C:\ProgramData\mntemp:8EAD8B3507 [7714]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [7714]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [7714]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Legion Arena.lnk:20903A5BF7 [7714]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote.lnk:60EC9648C0 [7714]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook (classic).lnk:5465085A2F [6002]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook (classic).lnk:BE800952D3 [7714]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk:1DC1525F34 [7714]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk:104946E0EA [6002]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sticky Notes (new).lnk:954E53D7F9 [7714]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk:7AD7FA8AB1 [7714]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [5442]
CustomCLSID: HKU\S-1-5-21-2794772896-3456025328-3779792213-1001_Classes\CLSID\{6a27a1a9-7be8-1491-04ca-ee68a211c258}\localserver32 -> "C:\Program Files\Google\Play Games\current\service\Service.exe" -ToastActivated => No File
ContextMenuHandlers1: [Kaspersky Free 21.15] -> {AE81D5A2-A34B-4D93-8DF8-540DBCE48043} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.15\x64\shellex.dll -> No File
ContextMenuHandlers1: [Kaspersky Free 21.16] -> {AE776072-9FCA-48AF-941C-5759266BB644} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.16\x64\shellex.dll -> No File
ContextMenuHandlers1: [Kaspersky Standard 21.15] -> {AE81D5A2-A34B-4D93-8DF8-540DBCE48043} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.15\x64\shellex.dll -> No File
ContextMenuHandlers2: [Kaspersky Free 21.15] -> {AE81D5A2-A34B-4D93-8DF8-540DBCE48043} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.15\x64\shellex.dll -> No File
ContextMenuHandlers2: [Kaspersky Free 21.16] -> {AE776072-9FCA-48AF-941C-5759266BB644} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.16\x64\shellex.dll -> No File
ContextMenuHandlers2: [Kaspersky Standard 21.15] -> {AE81D5A2-A34B-4D93-8DF8-540DBCE48043} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.15\x64\shellex.dll -> No File
ContextMenuHandlers4: [Kaspersky Free 21.15] -> {AE81D5A2-A34B-4D93-8DF8-540DBCE48043} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.15\x64\shellex.dll -> No File
ContextMenuHandlers4: [Kaspersky Free 21.16] -> {AE776072-9FCA-48AF-941C-5759266BB644} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.16\x64\shellex.dll -> No File
ContextMenuHandlers4: [Kaspersky Standard 21.15] -> {AE81D5A2-A34B-4D93-8DF8-540DBCE48043} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.15\x64\shellex.dll -> No File
ContextMenuHandlers6: [Kaspersky Free 21.15] -> {AE81D5A2-A34B-4D93-8DF8-540DBCE48043} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.15\x64\shellex.dll -> No File
ContextMenuHandlers6: [Kaspersky Free 21.16] -> {AE776072-9FCA-48AF-941C-5759266BB644} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.16\x64\shellex.dll -> No File
ContextMenuHandlers6: [Kaspersky Standard 21.15] -> {AE81D5A2-A34B-4D93-8DF8-540DBCE48043} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.15\x64\shellex.dll -> No File
FirewallRules: [UDP Query User{1CE791B0-1A4E-4636-9371-16F51E2C5A93}C:\games\classic_offensive\csgo.exe] => (Allow) C:\games\classic_offensive\csgo.exe => No File
FirewallRules: [TCP Query User{284306AE-F074-452B-BFC5-6A9E4586C344}C:\games\classic_offensive\csgo.exe] => (Allow) C:\games\classic_offensive\csgo.exe => No File
FirewallRules: [UDP Query User{E5127933-BCE9-4FF0-B0E4-417BF55133E6}C:\games\cs 1.6 warzone\hl.exe] => (Allow) C:\games\cs 1.6 warzone\hl.exe => No File
FirewallRules: [TCP Query User{8DB7FEEF-D4A7-4EC5-8754-BEC31FF7AF78}C:\games\cs 1.6 warzone\hl.exe] => (Allow) C:\games\cs 1.6 warzone\hl.exe => No File
FirewallRules: [UDP Query User{2864201C-A1AE-402E-8105-9AC5998D5859}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.202.0_x64__2p2nqsd0c76g0\app\chatgpt.exe] => (Allow) C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.202.0_x64__2p2nqsd0c76g0\app\chatgpt.exe => No File
FirewallRules: [TCP Query User{56948A68-5369-4ADE-87C2-7657EC40EA20}C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.202.0_x64__2p2nqsd0c76g0\app\chatgpt.exe] => (Allow) C:\program files\windowsapps\openai.chatgpt-desktop_1.2025.202.0_x64__2p2nqsd0c76g0\app\chatgpt.exe => No File
FirewallRules: [UDP Query User{2F5FE5C9-8BE8-4B6C-8DB5-877A444167FE}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe => No File
FirewallRules: [TCP Query User{2F63D456-5F17-4051-AC8E-981FA3B76F4B}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe => No File
FirewallRules: [UDP Query User{265F36CB-8A4A-4195-A6B8-BD48DFC0B248}C:\users\49176\appdata\local\temp\rar$exa17352.868\sdi_x64_r2503.exe] => (Allow) C:\users\49176\appdata\local\temp\rar$exa17352.868\sdi_x64_r2503.exe => No File
FirewallRules: [TCP Query User{DDF869D6-8406-423A-ADE8-C4F335CA366A}C:\users\49176\appdata\local\temp\rar$exa17352.868\sdi_x64_r2503.exe] => (Allow) C:\users\49176\appdata\local\temp\rar$exa17352.868\sdi_x64_r2503.exe => No File
FirewallRules: [{3F9AEB59-D82E-4B31-854E-51F9D2F35EFC}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALaunchHelper.exe => No File
FirewallRules: [{F8524D3B-C0D0-480B-99FD-D45356B10D47}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALocalHostSvc.exe => No File
FirewallRules: [{35669512-0BF5-4493-BB9A-E3347BA41DF2}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALocalHostSvc.exe => No File
FirewallRules: [{7158D182-A8E1-4270-A7F2-6B0B18286827}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAGEP.exe => No File
FirewallRules: [{F3C18AFA-49B9-4B71-B3D8-D2D1E165FC38}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAGEP.exe => No File
FirewallRules: [{D084BFB1-8405-4508-9F53-FE11483516CE}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.exe => No File
FirewallRules: [{87A38DEB-D27A-4261-A094-D54DABECB5D1}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.exe => No File
FirewallRules: [{9D91A88A-E173-4E72-ABD3-F23E2DF0C541}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAConnect_microsoft.exe => No File
FirewallRules: [{1A162FEB-5E73-49F0-A48E-1E392558D40B}] => (Allow) C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAConnect_microsoft.exe => No File
FirewallRules: [UDP Query User{283A2583-C11F-4864-A210-FB44F53A1ABF}C:\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe] => (Allow) C:\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe => No File
FirewallRules: [TCP Query User{2201FB95-3F44-443D-80B9-ABE9B17B8B11}C:\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe] => (Allow) C:\steam\steamapps\common\marvelrivals\marvelgame\marvel\binaries\win64\marvel-win64-shipping.exe => No File
FirewallRules: [{F172CBD8-1E2B-4353-B03A-1231FA28F3B8}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe => No File
FirewallRules: [{2DBD32BE-66D0-4222-8487-D39A4FBE2EFF}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe => No File
FirewallRules: [{83F7B365-990E-4EA8-9BA1-F237A67EEE74}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe => No File
FirewallRules: [{D59C91A8-960A-40BC-B56C-4A808C12BAC0}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe => No File
FirewallRules: [UDP Query User{0597D626-5E07-4D06-9CA9-3862FD122F66}C:\steam\steamapps\common\naraka bladepoint\narakabladepoint.exe] => (Allow) C:\steam\steamapps\common\naraka bladepoint\narakabladepoint.exe => No File
FirewallRules: [TCP Query User{63DC575E-2E3F-418C-A304-2670920587BD}C:\steam\steamapps\common\naraka bladepoint\narakabladepoint.exe] => (Allow) C:\steam\steamapps\common\naraka bladepoint\narakabladepoint.exe => No File
FirewallRules: [{6D330A88-F025-4C9E-B0AA-3FD0019531BB}] => (Allow) C:\Program Files (x86)\BlueStacks X\Cloud Game.exe => No File
FirewallRules: [{59B661BD-293B-41B7-8A9B-F118169A5161}] => (Allow) C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe => No File
FirewallRules: [{0E6BE437-7692-43CD-A279-4862C323768E}] => (Allow) C:\Program Files\BlueStacks_nxt\BlueStacksAppplayerWeb.exe => No File
FirewallRules: [{91A80354-6D40-40B7-8CF2-669C00922D91}] => (Allow) C:\Program Files\BlueStacks_nxt\HD-Player.exe => No File
FirewallRules: [{154D1169-E115-4A6A-896D-F31FEA9C7312}] => (Allow) C:\Program Files (x86)\Bignox\BigNoxVM\RT\NoxVMHandle.exe => No File
FirewallRules: [{4D10CE37-FB08-42C1-9DB7-AB3D0BF6CE9E}] => (Allow) C:\Program Files (x86)\Nox\bin\Nox.exe => No File
FirewallRules: [{0988fb18-b753-4ef7-a184-594118901424}] => (Allow) C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe => No File
FirewallRules: [{D3BB9B52-0F3D-4B18-B03C-9D562E64D176}] => (Allow) C:\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe => No File
FirewallRules: [{C95A4A8D-8A47-494E-843F-FF7EF64CBCFD}] => (Allow) C:\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe => No File
FirewallRules: [UDP Query User{182E1D48-90BB-4FDE-B3FF-69DC6FE400A1}C:\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\steam\steamapps\common\grand theft auto v\gta5.exe => No File
FirewallRules: [TCP Query User{5FDCF43C-292B-40BA-9114-D17BF6F1A829}C:\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\steam\steamapps\common\grand theft auto v\gta5.exe => No File
FirewallRules: [{79B5A634-CF20-4253-8F3F-F90D345DF177}] => (Allow) C:\GSClient 1.6\hl.exe => No File
FirewallRules: [{0A3FA981-1006-4747-99B1-2ADB49B5FA76}] => (Allow) C:\GSClient 1.6\hl.exe => No File
FirewallRules: [{8369F66D-5CEE-47CC-ADD3-D47489F98D7C}] => (Allow) C:\GSClient 1.6\hl.exe => No File
FirewallRules: [{A2A5BA3A-113A-4338-9C05-544ECB0E8D55}] => (Allow) C:\GSClient 1.6\hl.exe => No File
FirewallRules: [{AF7EB0D2-8C75-461E-9F02-F7C9D57F1F68}] => (Allow) C:\GSClient 1.6\hl.exe => No File
FirewallRules: [{A931832D-4864-4EAB-BA18-CA2790CF9F20}] => (Allow) C:\GSClient 1.6\hl.exe => No File
FirewallRules: [{EB10704E-9836-4445-AACE-9BD0EC16350B}] => (Allow) C:\GameLoop64\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File
FirewallRules: [{EF190179-C179-43CE-B934-50E44663DF19}] => (Allow) C:\GameLoop64\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File
FirewallRules: [{C9585DB6-978E-472B-AAA5-14B27CE54002}] => (Allow) C:\GameLoop64\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File
FirewallRules: [{40F52AC8-5904-4AC0-A01D-668EA72121E6}] => (Allow) C:\GameLoop64\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File
FirewallRules: [{6D4683A9-6D92-42DC-8112-C02D14A397DB}] => (Allow) C:\GameLoop64\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File
FirewallRules: [{51BECE01-B006-4C02-B0B6-3DD19851D0F3}] => (Allow) C:\GameLoop64\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File
FirewallRules: [UDP Query User{7498D5A4-ABE5-49A0-B697-43C95D3626B3}C:\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) C:\steam\steamapps\common\paladins\binaries\win64\paladins.exe => No File
FirewallRules: [TCP Query User{5B0BDC3B-AE31-4039-A63A-74DCDBCFE3EB}C:\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) C:\steam\steamapps\common\paladins\binaries\win64\paladins.exe => No File
FirewallRules: [UDP Query User{DFA0A3BD-2623-47AE-A09C-CA7F7149B0A3}C:\valorant\riot games\riot client\riotclientservices.exe] => (Allow) C:\valorant\riot games\riot client\riotclientservices.exe => No File
FirewallRules: [TCP Query User{2612E8D2-DFFC-401A-982C-14DAFEC1B61D}C:\valorant\riot games\riot client\riotclientservices.exe] => (Allow) C:\valorant\riot games\riot client\riotclientservices.exe => No File
FirewallRules: [UDP Query User{9883D698-4453-4B1F-A1B0-449985C2A478}C:\valorant\riot games\valorant\live\shootergame\binaries\win64\valorant-win64-shipping.exe] => (Allow) C:\valorant\riot games\valorant\live\shootergame\binaries\win64\valorant-win64-shipping.exe => No File
FirewallRules: [TCP Query User{B89E53C5-ACCA-422E-9172-3561881C26BE}C:\valorant\riot games\valorant\live\shootergame\binaries\win64\valorant-win64-shipping.exe] => (Allow) C:\valorant\riot games\valorant\live\shootergame\binaries\win64\valorant-win64-shipping.exe => No File
FirewallRules: [{D403B63C-9BD6-419B-8FDA-6AE55DA35450}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File
FirewallRules: [{E53C75A2-C9CB-4ED2-A790-B39AA347AE52}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File
FirewallRules: [{92D54749-B3D8-4E34-9BF5-618AE1D66803}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File
FirewallRules: [{BA1DA899-1B41-4B15-A4AD-D61A06EB991F}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File
FirewallRules: [{181D53A8-74C1-4797-AE7D-D0165B709578}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File
FirewallRules: [{4B053CC0-4B6A-4F3C-B2ED-357857F04076}] => (Allow) C:\Program Files\TxGameAssistant\AppMarket\DL\syzs_dl_svr.exe => No File
FirewallRules: [UDP Query User{B08B9041-01F4-4DAE-940D-81C47EC2C454}C:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) C:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe => No File
FirewallRules: [TCP Query User{B3CC726B-B000-49C4-98B2-209F4A62FE09}C:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe] => (Allow) C:\steam\steamapps\common\pubg\tslgame\binaries\win64\tslgame.exe => No File
FirewallRules: [UDP Query User{0CCD94E0-A4B0-4290-A1CF-7B7D4ACBC726}C:\steam\steamapps\common\fifa 23\fifa23.exe] => (Allow) C:\steam\steamapps\common\fifa 23\fifa23.exe => No File
FirewallRules: [TCP Query User{813FA0A9-72A2-47A4-8A34-4837A2F01255}C:\steam\steamapps\common\fifa 23\fifa23.exe] => (Allow) C:\steam\steamapps\common\fifa 23\fifa23.exe => No File
FirewallRules: [{1C13CD0B-0FF0-4851-B5AC-9D15547C90AE}] => (Allow) C:\Games\Counter-Strike WaRzOnE\hl.exe => No File
FirewallRules: [{136272F9-488D-46D6-867B-B25F1CDE3B14}] => (Allow) C:\Games\Counter-Strike WaRzOnE\hl.exe => No File
FirewallRules: [TCP Query User{165D581A-7A53-4260-BC75-7F450E4EBFDB}C:\steam\steamapps\common\ea sports fc 24\fc24.exe] => (Allow) C:\steam\steamapps\common\ea sports fc 24\fc24.exe => No File
FirewallRules: [UDP Query User{A990E23A-46BC-42AE-9200-7F290F729EB8}C:\steam\steamapps\common\ea sports fc 24\fc24.exe] => (Allow) C:\steam\steamapps\common\ea sports fc 24\fc24.exe => No File
FirewallRules: [TCP Query User{BC6E2B8A-F1DF-4B77-BE69-E8C64F6E19F3}C:\steam\steamapps\common\call of duty hq\cod22\cod22-cod.exe] => (Allow) C:\steam\steamapps\common\call of duty hq\cod22\cod22-cod.exe => No File
FirewallRules: [UDP Query User{92C90B4F-E3F5-45D4-86F5-B46BD9A3345A}C:\steam\steamapps\common\call of duty hq\cod22\cod22-cod.exe] => (Allow) C:\steam\steamapps\common\call of duty hq\cod22\cod22-cod.exe => No File
FirewallRules: [{CA62BE74-440C-4483-B157-0CEDB6B7D601}] => (Allow) C:\Program Files\Bitdefender\Bitdefender Security\bdntwrk.exe => No File
FirewallRules: [TCP Query User{72F58D9F-71F0-4ED4-89E6-7EFB993E3D71}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Block) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => No File
FirewallRules: [UDP Query User{2AE4490E-B6C8-4A21-AED8-E731DC9161F5}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Block) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe => No File
FirewallRules: [TCP Query User{8AD11EB1-53B7-46E9-917E-5CE26DEE1F46}C:\steam\steamapps\common\destiny 2\destiny2.exe] => (Allow) C:\steam\steamapps\common\destiny 2\destiny2.exe => No File
FirewallRules: [UDP Query User{B75A22C9-6D59-45EC-A45F-784F3712B40F}C:\steam\steamapps\common\destiny 2\destiny2.exe] => (Allow) C:\steam\steamapps\common\destiny 2\destiny2.exe => No File
FirewallRules: [TCP Query User{D6FE5A6B-C943-413F-95FF-67FF79099E22}C:\program files\epic games\fallguys\fallguys_client_game.exe] => (Block) C:\program files\epic games\fallguys\fallguys_client_game.exe => No File
FirewallRules: [UDP Query User{ABCCC306-1104-4FC8-AC92-BBC0EFDD3C7C}C:\program files\epic games\fallguys\fallguys_client_game.exe] => (Block) C:\program files\epic games\fallguys\fallguys_client_game.exe => No File
FirewallRules: [{A9C81F3E-8796-4191-A882-DB48389CB260}] => (Allow) C:\Users\49176\AppData\Local\Warframe\Downloaded\Public\Tools\Launcher.exe => No File
FirewallRules: [{0078D428-592B-4D91-AA6E-39736C0F37F2}] => (Allow) C:\Users\49176\AppData\Local\Warframe\Downloaded\Downloaded\Public\Warframe.x64.exe => No File
FirewallRules: [{4BA7AFD2-DBC1-47E3-AED7-4444F7566D8B}] => (Allow) C:\Users\49176\AppData\Local\Warframe\Downloaded\Downloaded\Public\Warframe.x64.exe => No File
FirewallRules: [{685BF28A-63C0-4E35-9203-67964DE3475E}] => (Allow) C:\Users\49176\AppData\Local\Warframe\Downloaded\Public\Tools\RemoteCrashSender.exe => No File
FirewallRules: [{B48A2C3E-6A75-46D0-944E-8ED97E274AFB}] => (Allow) C:\Users\49176\AppData\Local\Warframe\Downloaded\Public\Tools\Launcher.exe => No File
FirewallRules: [{B64D9B1B-BCBD-4A14-B411-09E27505E23C}] => (Allow) C:\Users\49176\AppData\Local\Warframe\Downloaded\Downloaded\Public\Warframe.x64.exe => No File
FirewallRules: [{964045E0-499F-4E70-974F-7EBE53A9D822}] => (Allow) C:\Users\49176\AppData\Local\Warframe\Downloaded\Downloaded\Public\Warframe.x64.exe => No File
FirewallRules: [{2D32A37E-AAB0-4242-90AD-1B721F0B0312}] => (Allow) C:\Users\49176\AppData\Local\Warframe\Downloaded\Public\Tools\RemoteCrashSender.exe => No File
FirewallRules: [TCP Query User{C4A1F29B-48F6-4B8A-AAC7-411DD12BA5F3}C:\steam\steamapps\common\ea sports fc 24\fc24.exe] => (Allow) C:\steam\steamapps\common\ea sports fc 24\fc24.exe => No File
FirewallRules: [UDP Query User{D390B86F-0C58-4A10-BAC2-68916596537B}C:\steam\steamapps\common\ea sports fc 24\fc24.exe] => (Allow) C:\steam\steamapps\common\ea sports fc 24\fc24.exe => No File
FirewallRules: [TCP Query User{BBBC5C98-C5F4-4708-B104-C17113300D98}C:\steam\steamapps\common\call of duty hq\cod23\cod23-cod.exe] => (Allow) C:\steam\steamapps\common\call of duty hq\cod23\cod23-cod.exe => No File
FirewallRules: [UDP Query User{4FF689B6-915B-4BF9-94FE-EE225A33BFD0}C:\steam\steamapps\common\call of duty hq\cod23\cod23-cod.exe] => (Allow) C:\steam\steamapps\common\call of duty hq\cod23\cod23-cod.exe => No File
FirewallRules: [TCP Query User{462866FC-624B-4B22-A7D9-C7070C09BE29}C:\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\steam\steamapps\common\grand theft auto v\gta5.exe => No File
FirewallRules: [UDP Query User{B0C0FCF5-DD98-431A-8134-1061DBB498A5}C:\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\steam\steamapps\common\grand theft auto v\gta5.exe => No File
FirewallRules: [TCP Query User{A0AA63B0-2A0E-4A11-A376-8CB9FDCC6A12}C:\users\49176\appdata\local\fivem\fivem.app\data\cache\subprocess\fivem_chromebrowser] => (Allow) C:\users\49176\appdata\local\fivem\fivem.app\data\cache\subprocess\fivem_chromebrowser => No File
FirewallRules: [UDP Query User{BE858BE8-5923-483A-81A8-67722C4ED657}C:\users\49176\appdata\local\fivem\fivem.app\data\cache\subprocess\fivem_chromebrowser] => (Allow) C:\users\49176\appdata\local\fivem\fivem.app\data\cache\subprocess\fivem_chromebrowser => No File
FirewallRules: [TCP Query User{FD81D56F-0D2E-4614-BDCC-C32A6EC93F06}C:\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) C:\steam\steamapps\common\paladins\binaries\win64\paladins.exe => No File
FirewallRules: [UDP Query User{C8BC588C-ECE1-42AA-8CDC-B8F0EBB45360}C:\steam\steamapps\common\paladins\binaries\win64\paladins.exe] => (Allow) C:\steam\steamapps\common\paladins\binaries\win64\paladins.exe => No File
FirewallRules: [TCP Query User{DC444CCF-902F-41DD-9C21-97819569BFDF}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe => No File
FirewallRules: [UDP Query User{B2919A0C-4086-4F01-850C-274EFADBBFD8}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe => No File
FirewallRules: [TCP Query User{628BAD86-D321-44AC-B003-AC24AA7AD5E5}C:\games\counter-strike\cstrike.exe] => (Allow) C:\games\counter-strike\cstrike.exe => No File
FirewallRules: [UDP Query User{58CF9663-29DC-485E-9B71-A6591C7405EE}C:\games\counter-strike\cstrike.exe] => (Allow) C:\games\counter-strike\cstrike.exe => No File
FirewallRules: [TCP Query User{5FFA7CE5-7475-47EC-9557-1FDC5D64C015}C:\games\counter-strike warzone\hl.exe] => (Allow) C:\games\counter-strike warzone\hl.exe => No File
FirewallRules: [UDP Query User{3A0A9303-DADD-4DEF-9369-48ED5A0E9F07}C:\games\counter-strike warzone\hl.exe] => (Allow) C:\games\counter-strike warzone\hl.exe => No File
FirewallRules: [{40FF21BB-4EB9-4B06-B9BE-18B813320C72}] => (Allow) C:\Steam\steamapps\common\Half-Life\hl.exe (Valve -> Valve)
FirewallRules: [{180B22E3-C9E0-43B3-9CDB-D3A378654641}] => (Allow) C:\Steam\steamapps\common\Half-Life\hl.exe (Valve -> Valve)
FirewallRules: [{3C76A76F-7D5E-4064-9B98-F955466B958F}] => (Allow) C:\Steam\steamapps\common\CSNZ\Bin\cstrike-online.exe => No File
FirewallRules: [{961079A0-0052-420B-80D9-1AAA65F223B9}] => (Allow) C:\Steam\steamapps\common\CSNZ\Bin\cstrike-online.exe => No File

StartRegedit:
Windows Registry Editor Version 5.00
[-HKEY_LOCAL_MACHINE\SOFTWARE\Bitdefender]
[HKEY_LOCAL_MACHINE\SOFTWARE\Bitdefender\Install]
"AgentPath"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Bitdefender Safepay]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Bitdefender Security App]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D19631EE-4E47-4BA9-BA2E-C5FF909E2C61}\1.0\0\win32]
""=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D19631EE-4E47-4BA9-BA2E-C5FF909E2C61}\1.0\HELPDIR]
""=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\NonPackaged\C:#Program Files#Bitdefender#Bitdefender Security#bdservicehost.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\NonPackaged\C:#Program Files#Bitdefender#Bitdefender Security#hntwhlpr.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\NonPackaged\C:#Program Files#Bitdefender#Bitdefender VPN#bdvpnService.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Thunderbird]
"ExtensionSettings"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Bitdefender Agent]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{CA62BE74-440C-4483-B157-0CEDB6B7D601}"=-
[HKEY_USERS\.DEFAULT\Software\SetId]
"BundleId"=-
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Bitdefender VPN]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Bitdefender VPN\Bitdefender VPN]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\NonPackaged\C:#Program Files#Bitdefender#Bitdefender Security#bduserhost.exe]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Cloud\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appleveltileinfo$appleveltilelist\windows.data.apps.appleveltileinfo$w~bitdefender]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Cloud\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appleveltileinfo$appleveltilelist\windows.data.apps.appleveltileinfo$w~{6d809377-6af0-444b-8957-a3773f02200e}bitdefenderbitdefender security appsafepayobk.exe]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Cloud\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appleveltileinfo$appleveltilelist\windows.data.apps.appleveltileinfo$w~{6d809377-6af0-444b-8957-a3773f02200e}bitdefenderbitdefender vpnbdvpnuiapp.exe]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Cloud\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appmetadata$appmetadatalist\windows.data.apps.appmetadata$bitdefender]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Cloud\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appmetadata$appmetadatalist\windows.data.apps.appmetadata$bitdefender agent]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Cloud\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appmetadata$appmetadatalist\windows.data.apps.appmetadata$bitdefender vpn]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Current\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appleveltileinfo$appleveltilelist\windows.data.apps.appleveltileinfo$w~bitdefender]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Current\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appleveltileinfo$appleveltilelist\windows.data.apps.appleveltileinfo$w~{6d809377-6af0-444b-8957-a3773f02200e}bitdefenderbitdefender security appsafepayobk.exe]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Current\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appleveltileinfo$appleveltilelist\windows.data.apps.appleveltileinfo$w~{6d809377-6af0-444b-8957-a3773f02200e}bitdefenderbitdefender vpnbdvpnuiapp.exe]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Current\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appmetadata$appmetadatalist\windows.data.apps.appmetadata$bitdefender]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Current\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appmetadata$appmetadatalist\windows.data.apps.appmetadata$bitdefender agent]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Current\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appmetadata$appmetadatalist\windows.data.apps.appmetadata$bitdefender vpn]
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched]
"{6D809377-6AF0-444B-8957-A3773F02200E}\Common Files\Bitdefender\SetupInformation\CL-27-B11CAF7C-0121-46B5-810E-35F393D7989A\installer.exe"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched]
"Bitdefender"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched]
"{6D809377-6AF0-444B-8957-A3773F02200E}\Bitdefender Agent\27.0.1.262\installer\installer.exe"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched]
"{6D809377-6AF0-444B-8957-A3773F02200E}\Common Files\Bitdefender\SetupInformation\CL-27-E7956D72-44AE-43C0-99C2-D36AF0844240\installer.exe"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched]
"{6D809377-6AF0-444B-8957-A3773F02200E}\Bitdefender Agent\27.0.1.262\ProductAgentUI.exe"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched]
"{6D809377-6AF0-444B-8957-A3773F02200E}\Common Files\Bitdefender\SetupInformation\CL-27-11C64FEF-2A06-462A-92CA-1C8E1B20BD33\installer.exe"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched]
"{6D809377-6AF0-444B-8957-A3773F02200E}\Bitdefender Agent\27.0.1.266\ProductAgentUI.exe"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched]
"{6D809377-6AF0-444B-8957-A3773F02200E}\Common Files\Bitdefender\SetupInformation\CL-27-FB4228AA-4E3C-4AE5-8942-C56D834DC37E\installer.exe"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched]
"{6D809377-6AF0-444B-8957-A3773F02200E}\Bitdefender\Bitdefender VPN\bdvpnuiapp.exe"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Users\49176\Downloads\bitdefender_avfree.exe"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-27-11C64FEF-2A06-462A-92CA-1C8E1B20BD33\installer.exe"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-27-FB4228AA-4E3C-4AE5-8942-C56D834DC37E\installer.exe"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Users\49176\Downloads\bitdefender_avfree (1).exe"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Program Files\Bitdefender\Bitdefender VPN\installer\installer.exe"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Program Files\Bitdefender Agent\27.1.1.14\installer\installer.exe"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AvastPersistentStorage]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\NonPackaged\C:#Program Files#Avast Software#Avast#aswToolsSvc.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\NonPackaged\C:#Program Files#Avast Software#Avast#AvastSvc.exe]
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Control Panel\NotifyIconSettings\13846472541453409974]
"ExecutablePath"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Control Panel\NotifyIconSettings\13846472541453409974]
"Publisher"=-
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\NonPackaged\C:#Program Files#Avast Software#Avast#AvastUI.exe]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Current\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appleveltileinfo$appleveltilelist\windows.data.apps.appleveltileinfo$w~avast! antivirus]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Current\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appmetadata$appmetadatalist\windows.data.apps.appmetadata$avast antivirus]
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched]
"avast! Antivirus"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Program Files\Avast Software\Avast\AvastUI.exe"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Program Files\Common Files\Avast Software\Icarus\avast-av\icarus.exe"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Kaspersky Free 21.15]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Kaspersky Free 21.16]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Kaspersky Standard 21.15]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7234FFB2-68A2-4C1D-9B65-174ED84C2A42}\InProcServer32]
""=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE776072-9FCA-48AF-941C-5759266BB644}\InProcServer32]
""=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE81D5A2-A34B-4D93-8DF8-540DBCE48043}\InProcServer32]
""=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B6AD0DB7-BC03-48C8-A7B4-3A4A8A7C53E2}\InProcServer32]
""=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Kaspersky Free 21.15]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Kaspersky Free 21.16]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Kaspersky Standard 21.15]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Kaspersky Free 21.15]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Kaspersky Free 21.16]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Kaspersky Standard 21.15]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Kaspersky Free 21.15]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Kaspersky Free 21.16]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Kaspersky Standard 21.15]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Kaspersky Free 21.15]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Kaspersky Free 21.16]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Kaspersky Standard 21.15]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43338FB7-0141-4f90-9789-094256BEC456}\Binaries]
"upgrade_launcher.exe"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7234FFB2-68A2-4C1D-9B65-174ED84C2A42}\InProcServer32]
""=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AE776072-9FCA-48AF-941C-5759266BB644}\InProcServer32]
""=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AE81D5A2-A34B-4D93-8DF8-540DBCE48043}\InProcServer32]
""=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6AD0DB7-BC03-48C8-A7B4-3A4A8A7C53E2}\InProcServer32]
""=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{4F76F112-43EB-40E8-11D8-F7BD1853EA23}]
"DISPLAYNAME"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{4F76F112-43EB-40E8-11D8-F7BD1853EA23}]
"PRODUCTEXE"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{4F76F112-43EB-40E8-11D8-F7BD1853EA23}]
"REPORTINGEXE"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageFamily\Data\be]
"PackageFamilyName"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageFamily\Data\be]
"Publisher"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageFamily\Data\be]
"_IndexKeys"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageFamily\Index\PackageFamilyName\Kaspersky.ShellEx22_b81m8cbssw9gt]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\NonPackaged\C:#Program Files (x86)#Kaspersky Lab#Kaspersky 21.22#avp.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Kaspersky Lab\AVP21.15\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Kaspersky Lab\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Kaspersky Lab\AVP21.15\Traces\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Kaspersky Lab\K4W-21-15\klhk\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Kaspersky Lab\K4W-21-15\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Kaspersky Lab\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Kaspersky Lab\AVP21.16\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Kaspersky Lab\AVP21.16\Bases\Cache\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Kaspersky Lab\AVP21.16\Bases\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Kaspersky Lab\AVP21.16\Temp\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Kaspersky Lab\AVP21.16\Traces\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Kaspersky Lab\K4W-21-16\klhk\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Kaspersky Lab\K4W-21-16\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Kaspersky Lab\AVP21.22\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Kaspersky Lab\AVP21.22\CatsStorage\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Kaspersky Lab\AVP21.22\Traces\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Kaspersky Lab\AVP21.22\Backup\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Kaspersky Lab\K4W-21-22\klhk\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Common Files\Kaspersky Lab\K4W-21-22\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Kaspersky Lab\AVP21.22\SavedData\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Kaspersky Lab\SafeBrowser\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\ProgramData\Kaspersky Lab\UCPStorage\"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab]
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\LicStrg]
"kaspersky4win"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Kaspersky Event Log]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Kaspersky Event Log\kis-safe_banking]
"EventMessageFile"=-
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\KasperskyLab]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\KasperskyLab\Kaspersky Password Manager]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\KasperskyLabSetup]
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\UserData\UninstallTimes]
"Kaspersky.ShellEx22_b81m8cbssw9gt"=-
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\AppHost\IndexedDB\Kaspersky.ShellEx16_b81m8cbssw9gt]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\AppHost\IndexedDB\Kaspersky.ShellEx_b81m8cbssw9gt]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\Kaspersky.ShellEx16_b81m8cbssw9gt]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\Kaspersky.ShellEx22_b81m8cbssw9gt]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\Kaspersky.ShellEx_b81m8cbssw9gt]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Cloud\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appleveltileinfo$appleveltilelist\windows.data.apps.appleveltileinfo$w~kasperskylab.kis.ui.toasts]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Cloud\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appmetadata$appmetadatalist\windows.data.apps.appmetadata$kaspersky.shellex16_b81m8cbssw9gt]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Cloud\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appmetadata$appmetadatalist\windows.data.apps.appmetadata$kaspersky.shellex22_b81m8cbssw9gt]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Cloud\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appmetadata$appmetadatalist\windows.data.apps.appmetadata$kaspersky.shellex_b81m8cbssw9gt]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Current\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appleveltileinfo$appleveltilelist\windows.data.apps.appleveltileinfo$w~kasperskylab.kis.ui.toasts]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Current\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appmetadata$appmetadatalist\windows.data.apps.appmetadata$kaspersky.shellex16_b81m8cbssw9gt]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Current\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appmetadata$appmetadatalist\windows.data.apps.appmetadata$kaspersky.shellex22_b81m8cbssw9gt]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Current\{2df707c3-ffa0-4fe4-a914-8b37083b3e92}$windows.data.apps.appmetadata$appmetadatalist\windows.data.apps.appmetadata$kaspersky.shellex_b81m8cbssw9gt]
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched]
"KasperskyLab.Kis.UI.Toasts"=-
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\KasperskyLab.Kis.UI.Toasts]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Kaspersky.ShellEx16_b81m8cbssw9gt!KasperskyPackageRegistrator]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Kaspersky.ShellEx_b81m8cbssw9gt!KasperskyPackageRegistrator]
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]
"C:\Users\49176\Downloads\kaspersky4win202121.22.7.466de_46457.exe"=-
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files (x86)%5CKaspersky Lab%5CKaspersky 21.15%5Cx64%5Cresources.pri]
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files (x86)%5CKaspersky Lab%5CKaspersky 21.15%5Cx64%5Cresources.pri\1da504fec804be1\cb4a2971]
"@{Kaspersky.ShellEx_1.0.0.4_x64__b81m8cbssw9gt?ms-resource://Kaspersky.ShellEx/Resources/DisplayName}"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files (x86)%5CKaspersky Lab%5CKaspersky 21.15%5Cx64%5Cresources.pri\1da504fec804be1\d756c420]
"@{Kaspersky.ShellEx_1.0.0.4_x64__b81m8cbssw9gt?ms-resource://Kaspersky.ShellEx/Resources/DisplayName}"=-
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files (x86)%5CKaspersky Lab%5CKaspersky 21.16%5Cx64%5Cresources.pri]
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files (x86)%5CKaspersky Lab%5CKaspersky 21.16%5Cx64%5Cresources.pri\1da7273ab54cf95\cb4a2971]
"@{Kaspersky.ShellEx16_1.0.0.5_x64__b81m8cbssw9gt?ms-resource://Kaspersky.ShellEx/Resources/DisplayName}"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3121550057-3593697083-3515899264-3795723056-1361198913-3405528534-3095427537]
"Moniker"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3505499223-3453805909-3779880461-1219457058-3339793060-1736105750-3518515709]
"Moniker"=-
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\kaspersky.shellex16_b81m8cbssw9gt]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\kaspersky.shellex_b81m8cbssw9gt]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Kaspersky.ShellEx16_1.0.0.5_x64__b81m8cbssw9gt]
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Kaspersky.ShellEx16_1.0.0.5_x64__b81m8cbssw9gt]
"PackageRootFolder"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Kaspersky.ShellEx16_1.0.0.5_x64__b81m8cbssw9gt]
"PackageID"=-
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Kaspersky.ShellEx_1.0.0.4_x64__b81m8cbssw9gt]
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Kaspersky.ShellEx_1.0.0.4_x64__b81m8cbssw9gt]
"PackageRootFolder"=-
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Kaspersky.ShellEx_1.0.0.4_x64__b81m8cbssw9gt]
"PackageID"=-
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Kaspersky.ShellEx16_b81m8cbssw9gt]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Kaspersky.ShellEx16_b81m8cbssw9gt\HAM\AUI\KasperskyPackageRegistrator]
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Kaspersky.ShellEx16_b81m8cbssw9gt\Schemas]
"PackageFullName"=-
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Kaspersky.ShellEx16_b81m8cbssw9gt\SplashScreen\Kaspersky.ShellEx16_b81m8cbssw9gt!KasperskyPackageRegistrator]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Kaspersky.ShellEx_b81m8cbssw9gt]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Kaspersky.ShellEx_b81m8cbssw9gt\HAM\AUI\KasperskyPackageRegistrator]
[HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Kaspersky.ShellEx_b81m8cbssw9gt\Schemas]
"PackageFullName"=-
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Kaspersky.ShellEx_b81m8cbssw9gt\SplashScreen\Kaspersky.ShellEx_b81m8cbssw9gt!KasperskyPackageRegistrator]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\PackagedCom\Package\Kaspersky.ShellEx16_1.0.0.5_x64__b81m8cbssw9gt]
[-HKEY_USERS\S-1-5-21-2794772896-3456025328-3779792213-1001\Software\Classes\PackagedCom\Package\Kaspersky.ShellEx_1.0.0.4_x64__b81m8cbssw9gt]
EndRegedit:

CMD: netsh int ip reset
CMD: ipconfig /flushDNS

CMD: sfc /scannow
CMD: DISM /Online /Cleanup-Image /RestoreHealth

EmptyTemp:
End::

ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на операционната ви система

Следните директории се изпразват:

Windows Temp
Users Temp folders
Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History
Recently opened files cache
Flash Player cache
Java cache
Steam HTML cache
Explorer thumbnail and icon cache
BITS transfer queue (qmgr*.dat files)
Recycle Bin

👉 Натиснете бутона Fix само веднъж и изчакайте.

Забележка: Не е необходимо да поставяте скрипта в FRST .
Рестартирайте компютъра, ако бъдете подканени.
Когато поправката е завършена, FRST ще генерира дневник на същото място, от което е стартиран (Fixlog.txt)
Моля, копирайте и поставете съдържанието му във вашия отговор.

2

20 август 202520 Авг

Автор

Ето файл-а.

П.С.: Направих една глупост, когато отворих помислих, че текста ще се добави автоматично във "Search". Защо си помислих това, като Search и Fix нямат общо не знам, но копирах текста натиснах Fix и след това исках да затворя програмата,но за късмет тя продължи да си работи което е супер. Fix-a си продължи, след това компютъра се рестартира и даде фикс-лога. Надявам се да не се е объркало нещо от моите глупости.

Fixlog.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

21 август 202521 Авг

Здравейте..! Сработил е фикса ,няма проблем...! Как се държи компютъра ви сега..? Има ли някаква разлика ..?

Да направим контролни проверки:

FRST сканиране

    Щракнете двукратно върху FRST.exe / FRST64.exe, за да го стартирате.
  Натиснете бутона Scan и изчакайте известно време.
    Когато приключи, той ще създаде два лог файла с името FRST.txt и Addition.txt, в същата директория, от която е стартиран инструментът.
    Моля, копирайте и поставете двата файла в следващия си отговор.

Сканиране с SecurityCheck by glax24

Изтеглете SecurityCheck by glax24 от тук и запомнете инструмента на десктопа .
Стартирате програмата (ако използвате Windows XP) или стартирате с десен бутон на мишката от името на администратор (ако използватеWindows Vista/7/8/10)
Изчакайте да приключи сканирането.Ще се отвори в текстов файл с име SecurityCheck.txt. Копирайте съдържанието на този файл следващия си пост
Можете да намерите този файл в основната директория на системния диск в папка с име SecurityCheck, напр. C:\SecurityCheck\SecurityCheck.txt

1

21 август 202521 Авг

Автор

Здравей, и добро утро!
Усеща се по-бързата работа със компютъра, но отново си премигва мишката и зарежда нещо... иначе има разлика!

Ето кода, и логовете -

SecurityCheck by glax24 & Severnyj v.1.4.0.58 [15.08.24]
WebSite: www.safezone.cc
DateLog: 21.08.2025 09:20:32
Path starting: C:\Users\49176\AppData\Local\Temp\SecurityCheck\SecurityCheck.exe
Log directory: C:\SecurityCheck\
IsAdmin: True
User: 49176
VersionXML: 14.59is-20.08.2025
___________________________________________________________________________

Windows 11 Core (x64) Release: 24H2 (10.0.26100.4946) Lang: German(0407)
Installation date OS: 16.08.2025 16:58:29
LicenseStatus: Windows(R), Core edition The machine is permanently activated.
LicenseStatus: Office 16, Office16OneNoteFreeR_Bypass edition The machine is permanently activated.
LicenseStatus: Office 16, Office16O365HomePremR_Grace edition Initial grace period ends :579 minutes
Boot Mode: Normal
Default Browser: C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
SystemDrive: C: FS: [NTFS] Capacity: [475.7 Gb] Used: [357.3 Gb] Free: [118.4 Gb]
------------------------------- [ Windows ] -------------------------------
User Account Control [b]enabled[/b] (Level 3)
Security Center (wscsvc) - The service is running
Remote Registry (RemoteRegistry) - The service has stopped
SSDP Discovery (SSDPSRV) - The service is running
Remote Desktop Services (TermService) - The service has stopped
Windows Remote Management (WS-Management) (WinRM) - The service has stopped
Background Intelligent Transfer Service (BITS) - The service is running
Delivery Optimization (DoSvc) - The service is running
Windows Security Service (SecurityHealthService) - The service is running
Update Orchestrator Service (UsoSvc) - The service is running
WaaSMedicSvc (WaaSMedicSvc) - The service has stopped
Windows Update (wuauserv) - The service has stopped
---------------------------- [ Antivirus_WMI ] ----------------------------
Windows Defender (enabled and up to date)
--------------------------- [ FirewallWindows ] ---------------------------
Windows Defender Firewall (mpssvc) - The service is running
--------------------------- [ OtherUtilities ] ----------------------------
AMD Software v.25.8.1
Microsoft 365 - bg-bg v.16.0.19029.20184
Microsoft 365 - de-de v.16.0.19029.20184
Microsoft Edge WebView2-Laufzeit v.139.0.3405.102
Steam v.2.10.91.91
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34438 v.14.42.34438.0 [color=red][b]Warning! [url=https://download.visualstudio.microsoft.com/download/pr/73aabf2e-9532-4f68-99f7-3247081a619c/CC0FF0EB1DC3F5188AE6300FAEF32BF5BEEBA4BDD6E8E445A9184072096B713B/VC_redist.x64.exe]Download Update[/url][/b][/color]
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.42.34438 v.14.42.34438.0 [color=red][b]Warning! [url=https://download.visualstudio.microsoft.com/download/pr/73aabf2e-9532-4f68-99f7-3247081a619c/0C09F2611660441084CE0DF425C51C11E147E6447963C3690F97E0B25C55ED64/VC_redist.x86.exe]Download Update[/url][/b][/color]
------------------------------- [ Backup ] --------------------------------
Microsoft OneDrive v.25.140.0720.0001
------------------------------ [ ArchAndFM ] ------------------------------
WinRAR 6.23 (64-bit) v.6.23.0 [color=red][b]Warning! [url=https://www.rarlab.com/download.htm]Download Update[/url][/b][/color]
-------------------------- [ IMAndCollaborate ] ---------------------------
Discord v.1.0.9017 [color=red][b]Warning! [url=https://stable.dl2.discordapp.net/distro/app/stable/win/x64/1.0.9202/DiscordSetup.exe]Download Update[/url][/b][/color]
-------------------------------- [ Media ] --------------------------------
VLC media player v.3.0.21
------------------------------- [ Browser ] -------------------------------
Brave v.139.1.81.136
Microsoft Edge v.139.0.3405.102
------------------ [ AntivirusFirewallProcessServices ] -------------------
Microsoft Defender Core Service (MDCoreSvc) - The service is running
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25070.5-0\MpDefenderCoreService.exe v.4.18.25070.5
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25070.5-0\MsMpEng.exe v.4.18.25070.5
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25070.5-0\NisSrv.exe v.4.18.25070.5
Microsoft Defender Antivirus Service (WinDefend) - The service is running
Microsoft Defender Antivirus Network Inspection Service (WdNisSvc) - The service is running
---------------------------- [ UnwantedApps ] -----------------------------
Driver Booster for Steam [b]Warning![/b] Suspected demo version of anti-spyware, driver updater or [url=https://support.microsoft.com/en-us/help/2563254/microsoft-support-policy-for-the-use-of-registry-cleaning-utilities]optimizer[/url]. If this program is not familiar to you it is recommended to uninstall it and execute PC scanning using [url=https://www.malwarebytes.com/mwb-download/thankyou]Malwarebytes Anti-Malware[/url]. Possible you became a victim of fraud or social engineering. Computer experts no longer recommend this program.
----------------------------- [ End of Log ] ------------------------------

FRST.txt Addition.txt

1

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

21 август 202521 Авг

Driver Booster for Steam ..Warning! Suspected demo version of anti-spyware, driver updater or optimizer. If this program is not familiar to you it is recommended to uninstall Computer experts no longer recommend this program.

Тази програма аз бих премахнал. Но все пак вие решавате в случая..! Мисля че програмата Logitech не работи коректно.. Бих я преинсталирал..! Липсват или повредени драйвери в случая:

R4 logi_joy_bus_enum; \SystemRoot\system32\drivers\logi_joy_bus_enum.sys [X]
S4 logi_joy_vir_hid; \SystemRoot\system32\drivers\logi_joy_vir_hid.sys [X]
R4 logi_joy_xlcore; \SystemRoot\system32\drivers\logi_joy_xlcore.sys [X]

Фикс с Farbar Recovery Scan Tool

Щракнете с десния бутон върху иконата FRST и изберете Изпълнете като администратор
Маркирайте информацията от карето по долу , след което натиснете клавишите Ctrl + C едновременно и текстът ще бъде копиран
Няма нужда да поставяте информацията , FRST ще я направи вместо вас.

Start::
CloseProcesses:

C:\WINDOWS\system32\ddsStjrcte
C:\WINDOWS\system32\vmbusLuusiwwcarwyb
C:\WINDOWS\system32\UvvWhvlnbymdemqan
C:\WINDOWS\system32\HidWzzyuuxkbmx
C:\WINDOWS\system32\BillQkvdyflbka

EmptyTemp:
End::

ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на операционната ви система

Натиснете бутона Fix само веднъж и изчакайте.

Забележка: Не е необходимо да поставяте скрипта в FRST .
Рестартирайте компютъра, ако бъдете подканени.
Когато поправката е завършена, FRST ще генерира дневник на същото място, от което е стартиран (Fixlog.txt)
Моля, копирайте и поставете съдържанието му във вашия отговор.

1

21 август 202521 Авг

Автор

Дейнсталирани са и двете програми.

Fixlog.txt

1

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

21 август 202521 Авг

преди 23 минути, - Factory. написа:

Дейнсталирани са и двете програми.

Момент.. Да уточним .. преди моя пост ли са деинсталирани или след това ..визирам Logitech ..?

21 август 202521 Авг

Автор

преди 44 минути, icotonev написа:

Момент.. Да уточним .. преди моя пост ли са деинсталирани или след това ..визирам Logitech ..?

Пуснах фикс-а и след това ги деинсталирах.

Поръчах една мишка Logitech G305, но се оказа фалшива и върнах поръчката. Софтуера не я разпознаваше и мишката не работеше правилно.

Имам и друга на същият бранд разпозна я.

Да добавя още нещо. Сега докато пиша пуснах на малката да гледа детски на лаптопа, лаптопа зацепи, звук-а прекъсваше все едно провеждаш разговор, но нямаш сигнал, а и така работеше и лаптопа и това става във рамките на 2 сек. след това се оправя. GPU/CPU са на 51 градуса. Това, че прекъсва така не го прави често, но го прави!

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

21 август 202521 Авг

преди 1 час, - Factory. написа:

Пуснах фикс-а и след това ги деинсталирах.

Да видим какво е останало от цялата работа..! Мисля че вървим към финал.. но пак да не бързам..!

Сканиране с AdwCleaner (режим на сканиране (Scan mode)

Изтеглете AdwCleaner и го запазете на вашия работен плот.

Щракнете двукратно върху AdwCleaner.exe, за да го стартирате.
Щракнете върху Сканиране сега (Scan Now)
Когато сканирането приключи, ще се отвори прозорец с резултати от сканиране.
Разделът в долната част под Предварително инсталиран софтуер (Pre-Installed Software) е софтуер, който очевидно е бил инсталиран, когато устройството е било ново от производителя на компютъра. Лично аз не пазя нищо от този софтуер, което да не използвам/от което да не се нуждая. Но това е вашият компютър, така че решението е ваше.
Щракнете върху Отказ ( Cancel) (в този момент не се опитвайте да поставите под карантина нищо, което е намерено)
Сега щракнете върху раздела Log Files.
Щракнете двукратно върху последния дневник за сканиране (регистрационните файлове за сканиране имат префикс [S0*], където * се заменя с число. Последното сканиране ще има най-голямо число)
Ще се отвори файл на Notepad, съдържащ резултатите от сканирането.

Моля, публикувайте съдържанието на файла в следващия си отговор.

Fresh FRST сканиране

    Щракнете двукратно върху FRST.exe / FRST64.exe, за да го стартирате.
  Натиснете бутона Scan и изчакайте известно време.
    Когато приключи, той ще създаде два лог файла с името FRST.txt и Addition.txt, в същата директория, от която е стартиран инструментът.
    Моля, копирайте и поставете двата файла в следващия си отговор.

21 август 202521 Авг

Автор

Ето информацията от файла на AdwCleaner.

# -------------------------------
# Malwarebytes AdwCleaner 8.5.0.595
# -------------------------------
# Build:    03-05-2025
# Database: 2024-10-23.4 (Local)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start:    08-21-2025
# Duration: 00:00:10
# OS:       Windows 11 (Build 26100.4946)
# Scanned:  32105
# Detected: 9


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

PUP.Optional.AdvancedSystemCare C:\Users\49176\AppData\Roaming\IObit\Advanced SystemCare
PUP.Optional.Legacy             C:\ProgramData\Tencent
PUP.Optional.Legacy             C:\Users\49176\AppData\Local\Tencent
PUP.Optional.Legacy             C:\Users\49176\AppData\Roaming\Tencent

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Hosts File Entries ] *****

No malicious hosts file entries found.

***** [ Preinstalled Software ] *****

Preinstalled.LenovoIMController   Folder   C:\ProgramData\LENOVO\IMCONTROLLER 
Preinstalled.LenovoIMController   Folder   C:\Users\49176\AppData\Local\LENOVO\IMCONTROLLER 
Preinstalled.LenovoIMController   Folder   C:\Windows\LENOVO\IMCONTROLLER 
Preinstalled.LenovoIMController   Folder   C:\Windows\System32\Tasks\LENOVO\IMCONTROLLER 
Preinstalled.LenovoIMController   Registry   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\Lenovo Dependency Package_is1 



########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

Ето и лог файловете от FRST.

FRST.txt Addition.txt

1

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

22 август 202522 Авг

Добро утро..! Добре изглеждат последните дневници..! Остана да махнем тези папки засечени от AdwCleaner...и да премахнем всичко което използвахме в почистването...!

Фикс с Farbar Recovery Scan Tool

Щракнете с десния бутон върху иконата FRST и изберете Изпълнете като администратор
Маркирайте информацията от карето по долу , след което натиснете клавишите Ctrl + C едновременно и текстът ще бъде копиран
Няма нужда да поставяте информацията , FRST ще я направи вместо вас.

Start::
CloseProcesses:

C:\Users\49176\AppData\Roaming\IObit\Advanced SystemCare
C:\ProgramData\Tencent
C:\Users\49176\AppData\Local\Tencent
C:\Users\49176\AppData\Roaming\Tencent

EmptyTemp:
Reboot:
End::

ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на операционната ви система

Натиснете бутона Fix само веднъж и изчакайте.

Забележка: Не е необходимо да поставяте скрипта в FRST .
Рестартирайте компютъра, ако бъдете подканени.
Когато поправката е завършена, FRST ще генерира дневник на същото място, от което е стартиран (Fixlog.txt)
Моля, копирайте и поставете съдържанието му във вашия отговор.

22 август 202522 Авг

Автор

Добро утро ето и фикс лог-а! :emoji_smiley-04:

Fixlog.txt

1

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

22 август 202522 Авг

Чудесно..! Ами това е от мен..! Как е сега "пациента"..? Наблюдавайте няколко дни как работи системата ви...Аз ще оставя темата активна и ако има нещо пишете..!

Останаха две неща.. Обновете следния софтуер:

Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34438 v.14.42.34438.0 Warning! Download Update
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.42.34438 v.14.42.34438.0 Warning! Download Update
WinRAR 6.23 (64-bit) v.6.23.0 Warning! Download Update
Discord v.1.0.9017 Warning! Download Update

..и да премахнем инструментите които използвахме:

Изтеглете KpRm и го запазете на вашия работен плот.

Бележка: Ако файлът бъде открит като зловреден софтуер, той не е и е безопасен за изтегляне. Откриването е фалшиво положително.

Щракнете с десния бутон върху иконата и изберете Run as administrator
Щракнете върху Yes върху отказа от отговорност
Поставете отметка на Delete Tools, Create Restore Point, and Delete now
Кликнете Run
Щракнете върху OK на All operations are completed
KpRm ще се изтрие от вашия работен плот и можете да запазите или премахнете генерирания отчет
Можете да премахнете всички останали инструменти/отчети
Моля, копирайте и поставете съдържанието му в следващия си отговор.

22 август 202522 Авг

Автор

Компютъра мисля, че работи по-добре от преди, а ако не със сигурност е по-изчистен благодарение на Вас!

# Run at 8/22/2025 5:03:17 PM
# KpRm (Kernel-panik) version 2.20.0
# Website https://kernel-panik.me/tool/kprm/
# Run by 49176 from C:\Users\49176\Desktop
# Computer Name: LAPTOP-84OIIQTL
# OS: Windows 11 X64 (26100) (10.0.26100.4946) 
# Number of passes: 1

- Checked options -

    ~ Delete Tools
    ~ Delete Restore Points
    ~ Delete Quarantines

- Delete Tools -


  ## AdwCleaner
     [OK] C:\Users\49176\Desktop\AdwCleaner.exe deleted
     [OK] C:\AdwCleaner deleted

  ## FRST
     [OK] C:\Users\49176\Desktop\Fixlog.txt deleted
     [OK] C:\Users\49176\Desktop\FRST-OlderVersion deleted
     [OK] C:\Users\49176\Desktop\FRST64.exe deleted
     [OK] C:\Users\49176\Desktop\New folder\Addition.txt deleted
     [OK] C:\Users\49176\Desktop\New folder\Fixlog.txt deleted
     [OK] C:\Users\49176\Desktop\New folder\FRST.txt deleted
     [OK] C:\Users\49176\Desktop\New folder\Search.txt deleted
     [OK] C:\FRST deleted

  ## SecurityCheck
     [OK] C:\Users\49176\Desktop\SecurityCheck.exe deleted
     [OK] C:\SecurityCheck deleted

- Clear Restore Points -

   ~ [OK] RP named Windows Update created at 08/16/2025 17:02:59 deleted
   ~ [OK] RP named Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34438 created at 08/20/2025 07:55:36 deleted
   ~ [OK] RP named Restore Point Created by FRST created at 08/20/2025 19:53:17 deleted
   ~ [OK] RP named Removed Epic Online Services created at 08/21/2025 07:11:32 deleted
   ~ [OK] RP named Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.44.35211 created at 08/22/2025 14:54:16 deleted
     [OK] All system restore points have been successfully deleted

-- KPRM finished in 13.64s --

Ще го по-изчистия като си купя флаш драйв, а уикенда ще го изчистя и сменя термо пастата, защото повече от 2 години не е отварян, а сега ще е за първи път.
Единственото което остана е, че зарежда нещо (така показва мишката) от време на време и това, че вчера докато малката гледаше детски прекъсваше, а не е за 1 път, но
не е фатално свиква се явно му тежи нещо.

Благодаря ти за времето и усилията! До 7 дни ще дам обратна връзка ако има нещо! :dancing-minion:

Spoiler

( След 7 дни може най-спокойно да заключиш темата. <3 )

1

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

22 август 202522 Авг

преди 8 минути, - Factory. написа:

Единственото което остана е, че зарежда нещо (така показва мишката) от време на време и това,

Предложение.. може да пуснеш един Autoruns да видим какво ще каже той..:

Изтеглете Autoruns и:

Стартирайте програмата;
Изберете Options => сложете отметки пред Hide Empty Locations, Hide Microsoft Entries и Hide Windows Entries и махнете отметката пред Hide VirusTotal Clean Entries;
Сега изберете Options => Scan Options => и сложете отметки пред Verify Code Signature, Check VirusTotal.com и Submit Unknown Images;
Изберете бутона F5 за да се повтори проверката. Изчакайте да приключи (ще разберете, че е така ако в долния ляв край на програмата изпише Ready.);
От менюто File => изберете Save => запазете файла някъде с желано от вас име (във формат arn), архивирайте го с програма по желание в zip формат и го прикачете към темата.

1

22 август 202522 Авг

Автор

Ето и от Autoruns информацията. :emoji_smiley-04:

LAPTOP-84OIIQTL.zip

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

22 август 202522 Авг

Нещо не мога да го отворя ...Изчака ли да изпише Ready в долния ляв ъгъл ..?

1

22 август 202522 Авг

Автор

преди 4 минути, icotonev написа:

Нещо не мога да го отворя ...Изчака ли да изпише Ready в долния ляв ъгъл ..?

Hm... да опитаме отново, но като админстратор.

LAPTOP-new.zip

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

22 август 202522 Авг

В секцията Logon мисля че трябва да махнеш отметките....

22 август 202522 Авг

Автор

преди 30 минути, icotonev написа:

В секцията Logon мисля че трябва да махнеш отметките....

Ще ги махна, ауторунс-а да го оставя във компютъра?

Сега видях имам Windows.old мога ли да го изтрия? Не си спомням да съм правил рековъри или нещо подобно...

Добре дошли!

Съмнение за зараза - Компютъра работи по-бавно от преди, мишката премигва.

Featured Replies

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)