CreateRestorePoint:
HOSTS:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {997A2EAC-0E5D-4E7A-B06D-63E7D7D59083} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe  (No File)
Task: {4D13C275-D10A-4781-A8DD-C2AB2CF1259B} - System32\Tasks\Meta\Messenger-SL-Helper-S-1-5-21-1853337303-587913857-1021407215-1001 => C:\Users\Dovel\AppData\Local\Programs\Messenger\MessengerHelper.exe  --lassie (No File)
Task: {BD436162-584D-4CA0-B6B4-533F6C7C6A74} - System32\Tasks\Meta\Messenger-WSP-Helper-S-1-5-21-1853337303-587913857-1021407215-1001 => MessengerHelper.exe  --lassie (No File)
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (No File)
Task: {0BB36A32-0D9E-4297-AFD7-6BD7B5DB4C9B} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => %windir%\System32\UNP\UpdateNotificationMgr.exe  (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
Task: {D3A1224A-8C60-490F-B5C4-1639337FD17F} - System32\Tasks\NortonLifeLock Trial Agent V2 => "C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NLOKTrialAgentV2.exe"  /scheduled (No File)
Task: {94C9FFEC-5710-47E0-B7D4-EA0649EFFFC0} - System32\Tasks\Opera scheduled Autoupdate 1689605662 => C:\Users\Dovel\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe  --scheduledtask --bypasslauncher $(Arg0) (No File)
Task: {9FEC1888-673D-4FF2-9141-CA5AA877E320} - System32\Tasks\Opera scheduled Autoupdate 1749568157 => C:\Users\Dovel\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe  --scheduledtask $(Arg0) (No File)
File: C:\Users\Dovel\AppData\Local\yzsx_zsync_1726072685\zbrain_desktop.exe
File: C:\Program Files (x86)\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\varpc.exe
S3 Reason.SnowService.f4f801e4; "C:\Program Files\ReasonLabs\EPP\Reason.Snow.exe" svc f4f801e4 terminate rsEngineSvc (No File)
S3 phantomtap; C:\WINDOWS\System32\drivers\phantomtap.sys [50248 2020-07-06] (Avira Operations GmbH & Co. KG -> The OpenVPN Project)
S3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [27136 2016-04-21] (The OpenVPN Project) [File not signed]
S3 tapnordvpn; C:\WINDOWS\System32\drivers\tapnordvpn.sys [49744 2023-02-20] (nordvpn s.a. -> The OpenVPN Project)
StartBatch:
md C:\DrvStore2
PnpUtil /export-driver * C:\DrvStore2
rundll32.exe c:\windows\system32\pnpclean.dll,RunDLL_PnpClean /DRIVERS /MAXCLEAN
rundll32.exe c:\windows\system32\pnpclean.dll,RunDLL_PnpClean /DEVICES /MAXCLEAN
DISM /online /get-drivers /format:table
fltmc
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class" /f *erfilters* /s
pnputil /enum-devices /problem /ids
c:\windows\system32\wbem\wmic.exe bios get /format:list
EndBatch:
StartPowerShell:
Get-MpPreference | select Exclusion*, ThreatID*, Control*
$Paths=(Get-MpPreference).ExclusionPath
foreach ($Path in $Paths) { Remove-MpPreference -ExclusionPath $Path -Verbose}
$Extensions=(Get-MpPreference).ExclusionExtension
foreach ($Extension in $Extensions) { Remove-MpPreference -ExclusionExtension $Extension -Verbose}
$Processes=(Get-MpPreference).ExclusionProcess
foreach ($Process in $Processes) { Remove-MpPreference -ExclusionProcess $Process -Verbose}
$ThreatIds = (Get-MpPreference).ThreatIDDefaultAction_Ids
Foreach ($ThreatId in $ThreatIds) { Remove-MpPreference -ThreatIDDefaultAction_Ids $ThreatId -Verbose }
Get-MpPreference
Get-MpComputerStatus
EndPowerShell:
CustomCLSID: HKU\S-1-5-21-1853337303-587913857-1021407215-1001_Classes\CLSID\{4e6f7264-5650-4e00-0000-000000000000}\localserver32 -> "C:\Program Files\NordVPN\NordVPN.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-1853337303-587913857-1021407215-1001_Classes\CLSID\{6a27a1a9-7be8-1491-04ca-ee68a211c258}\localserver32 -> "C:\Program Files\Google\Play Games\current\service\Service.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-1853337303-587913857-1021407215-1001_Classes\CLSID\{89b2b650-c4dd-d68b-46e7-3176f1973c8b}\localserver32 -> "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe" -ToastActivated => No File
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} =>  -> No File
AlternateDataStreams: C:\WINDOWS\system32\$Acer$.cmd:48CE61F693 [5994]
AlternateDataStreams: C:\ProgramData\mntemp:8EAD8B3507 [2134]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [2134]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat DC.lnk:1069064143 [2134]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller DC.lnk:9185529B88 [2134]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\App Explorer.lnk:4C32B9D343 [2134]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [2134]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [2134]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Forge of Empires.url:1368113D25 [2134]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote.lnk:60EC9648C0 [2134]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook (classic).lnk:5465085A2F [2134]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook (classic).lnk:BE800952D3 [2134]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Parblo Tablet Setting.lnk:D057A1F6D7 [2134]
FirewallRules: [UDP Query User{D512C723-02C0-4677-BCAA-86F60C821370}C:\users\dovel\downloads\sdi_r2601\sdi_r2601.exe] => (Allow) C:\users\dovel\downloads\sdi_r2601\sdi_r2601.exe => No File
FirewallRules: [TCP Query User{1515FC31-F43E-44D2-811A-166A4997AF4B}C:\users\dovel\downloads\sdi_r2601\sdi_r2601.exe] => (Allow) C:\users\dovel\downloads\sdi_r2601\sdi_r2601.exe => No File
FirewallRules: [UDP Query User{A6CC8153-68AF-428E-B7A5-E5AD27CA9646}C:\users\dovel\downloads\sdi_r2601\sdi_x64_r2601.exe] => (Block) C:\users\dovel\downloads\sdi_r2601\sdi_x64_r2601.exe => No File
FirewallRules: [TCP Query User{C193F1DE-1E8C-41D1-82C4-A8D3E900DAB5}C:\users\dovel\downloads\sdi_r2601\sdi_x64_r2601.exe] => (Block) C:\users\dovel\downloads\sdi_r2601\sdi_x64_r2601.exe => No File
FirewallRules: [UDP Query User{C773CAF8-F54B-46E6-8B58-020AAC3C7BDA}C:\users\dovel\appdata\local\programs\opera gx\opera.exe] => (Block) C:\users\dovel\appdata\local\programs\opera gx\opera.exe => No File
FirewallRules: [TCP Query User{87FB9EAF-0C96-4888-90A0-4F9401207720}C:\users\dovel\appdata\local\programs\opera gx\opera.exe] => (Block) C:\users\dovel\appdata\local\programs\opera gx\opera.exe => No File
FirewallRules: [UDP Query User{CD4672D4-F3BA-4BDF-8710-CCFFD21E6F38}C:\programdata\dovel\discord\app-1.0.9260\discord.exe] => (Block) C:\programdata\dovel\discord\app-1.0.9260\discord.exe => No File
FirewallRules: [TCP Query User{F9FCC487-B6DD-4CA4-8DCD-BDB023C7A2E3}C:\programdata\dovel\discord\app-1.0.9260\discord.exe] => (Block) C:\programdata\dovel\discord\app-1.0.9260\discord.exe => No File
FirewallRules: [{A31CC34C-40DC-49C3-B868-E7E0A101190E}] => (Allow) C:\Users\Dovel\AppData\Local\Programs\Opera\opera.exe => No File
FirewallRules: [{65B3EBE6-C712-4F77-9125-B17079A9C8FF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\PlateUp\PlateUp\PlateUp.exe => No File
FirewallRules: [{A10BEFE4-869E-4496-B512-BA0F7C687287}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\PlateUp\PlateUp\PlateUp.exe => No File
FirewallRules: [{A2BEF700-DB9F-4934-9F0C-39449CAA059A}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{D303B7E0-94F9-425C-AB8B-82018CD5B32B}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [TCP Query User{965FBF5D-0243-4214-B0A8-0600322B24B5}C:\program files\windowsapps\spotifyab.spotifymusic_1.253.438.0_x64__zpdnekdrzrea0\spotify.exe] => (Allow) C:\program files\windowsapps\spotifyab.spotifymusic_1.253.438.0_x64__zpdnekdrzrea0\spotify.exe => No File
FirewallRules: [UDP Query User{9C552F22-F7D1-499B-AB51-FC1C2A4D2ADC}C:\program files\windowsapps\spotifyab.spotifymusic_1.253.438.0_x64__zpdnekdrzrea0\spotify.exe] => (Allow) C:\program files\windowsapps\spotifyab.spotifymusic_1.253.438.0_x64__zpdnekdrzrea0\spotify.exe => No File
FirewallRules: [{42BE7F16-01C1-4093-AB56-197B5BE111A4}] => (Allow) C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot.exe => No File
Reboot: