Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 16-06-2021
Ran by User (administrator) on SAMSUNG (SAMSUNG ELECTRONICS CO., LTD. 700Z3A/700Z4A/700Z5A/700Z5B) (16-06-2021 13:48:36)
Running from Y:\AppData\file\FRST64
Loaded Profiles: User
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Default browser: Chrome
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() [File not signed] C:\Program Files (x86)\Ephere\LicenseServer\EphereLicenseServer.exe
() [File not signed] C:\Program Files\Autodesk 3ds max 2012\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe
(Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Advanced Micro Devices, Inc. -> Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Advanced Micro Devices, Inc. -> Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Apple Inc. -> Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc. -> Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Arvato Digital Services Canada Inc -> arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(DISKEEPER CORPORATION -> Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe
(ELAN Microelectronics Corporation -> ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(ELAN Microelectronics Corporation -> ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleCrashHandler.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleCrashHandler64.exe
(GuinpinSoft inc) [File not signed] C:\Program Files\Common Files\cdarbsvc\cdarbsvc_v1.0.0_x64.exe
(Huawei Technologies Co., Ltd. -> ) [File not signed] C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
(InstallShield Software Corporation) [File not signed] C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe
(Intel Corporation - Mobile Wireless Group -> Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel Corporation - Mobile Wireless Group -> Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel Corporation - Mobile Wireless Group -> Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation - Mobile Wireless Group -> Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation -> Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation -> Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation -> Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation -> Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 18.0.0\avp.exe
(Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 18.0.0\avpui.exe
(Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 2.0\ksde.exe
(Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 2.0\ksdeui.exe
(Mega Limited -> Mega Limited) C:\Users\User\AppData\Local\MEGAsync\MEGAsync.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atiesrxx.exe
(Piriform Ltd -> Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Raptr, Inc -> Raptr Inc.) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_ep64.exe
(Raptr, Inc -> Raptr, Inc) C:\Program Files (x86)\Raptr Inc\Raptr\raptr.exe
(Raptr, Inc -> Raptr, Inc) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_im.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Samsung Electronics CO., LTD. -> ) [File not signed] C:\Program Files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe
(Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.) [File not signed] C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe
(Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.) [File not signed] C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe
(Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.) [File not signed] C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe
(Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
(Samsung Electronics CO., LTD. -> Samsung Electronics) [File not signed] C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe
(SoundMixer) [File not signed] C:\Users\User\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve -> Valve Corporation) Y:\AppData\Steam\bin\cef\cef.win7x64\steamwebhelper.exe <7>
(Valve -> Valve Corporation) Y:\AppData\Steam\steam.exe
(北京海誉动想科技股份有限公司 -> ) C:\Program Files (x86)\Droid4X\Droid4XService.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12661352 2011-08-02] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2776872 2011-09-01] (ELAN Microelectronics Corporation -> ELAN Microelectronics Corp.)
HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [3325520 2020-05-05] (Adobe Inc. -> Adobe Systems, Incorporated)
HKLM-x32\...\Run: [ISUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2004-06-16] (InstallShield Software Corporation) [File not signed]
HKLM-x32\...\Run: [EphereLicenseServerFlux] => C:\Program Files (x86)\Ephere\LicenseServer\EphereLicenseServer.exe [110373 2017-03-25] () [File not signed]
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-02-18] (Intel Corporation -> Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-04] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-28] (Apple Inc. -> Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-19] (Apple Inc.) [File not signed]
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr Inc\Raptr\raptrstub.exe [58584 2017-05-30] (Raptr, Inc -> Raptr, Inc)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD) [File not signed]
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\Run: [ISUSPM Startup] => c:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2004-06-16] (InstallShield Software Corporation) [File not signed]
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd -> Disc Soft Ltd)
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9292504 2016-12-21] (Piriform Ltd -> Piriform Ltd)
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\Run: [Steam] => Y:\AppData\Steam\steam.exe [4109032 2021-06-09] (Valve -> Valve Corporation)
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\Run: [Opera Browser Assistant] => C:\Users\User\AppData\Local\Programs\Opera\assistant\browser_assistant.exe [4078288 2021-06-15] (Opera Software AS -> Opera Software)
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\MountPoints2: F - F:\AutoRun.exe
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\MountPoints2: {0ddac0bb-e8e7-11e9-baf6-ac7debe4829d} - E:\AutoRun.exe
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\MountPoints2: {2596f7c1-3777-11ea-98f0-ac7debe4829d} - E:\AutoRun.exe
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\MountPoints2: {84207902-9a3a-11e9-a898-ac7debe4829d} - F:\AutoRun.exe
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\MountPoints2: {97f9a811-de25-11e9-969b-ac7debe4829d} - F:\HiSuiteDownLoader.exe
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\MountPoints2: {97f9a81a-de25-11e9-969b-ac7debe4829d} - E:\HiSuiteDownLoader.exe
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\MountPoints2: {e8eb9b20-686d-11ea-9e24-ac7debe4829d} - E:\HiSuiteDownLoader.exe
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\MountPoints2: {f61f803b-4c20-11eb-a2b4-ac7debe4829d} - E:\AutoRun.exe
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [3229696 2016-08-29] (Microsoft Windows -> Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-3753424090-3426142987-573532147-1000\...\Command Processor: @mode 15,1 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist "C:\Users\User\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" ( start /MIN "" "C:\Users\User\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== ATTENTION
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2016-12-07] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Print\Monitors\PDF-XChange V6 Printer Port Monitor (Lite): C:\Windows\system32\pxcpm5L.dll [150720 2017-03-07] (Tracker Software Products (Canada) Ltd -> Tracker Software Products (Canada) Ltd.)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\91.0.4472.106\Installer\chrmstp.exe [2021-06-15] (Google LLC -> Google LLC)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2019-11-12]
ShortcutTarget: MEGAsync.lnk -> C:\Users\User\AppData\Local\MEGAsync\MEGAsync.exe (Mega Limited -> Mega Limited)

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {132F6300-480D-4988-BD96-8CA59822C50A} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1557200 2021-01-25] (Adobe Inc. -> Adobe Inc.)
Task: {1A4F5EBF-A647-479C-8ECE-C438C076DDDB} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\Easy Settings\EBM\EasyBatteryMgr4.exe [365960 2011-11-19] (Samsung Electronics CO., LTD. -> SAMSUNG Electronics co., LTD.) [File not signed]
Task: {1C0FE384-4826-4CE1-BD2D-2E49E17EE644} - System32\Tasks\SmartSetting => C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe [2279304 2012-05-02] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.) [File not signed]
Task: {1CB459C6-A431-47D5-A2D7-75405E6D8BE2} - System32\Tasks\WinZipBackGroundToolsTask => C:\Program Files\WinZip\WzBGTools.exe [249440 2016-12-13] (WinZip Computing LLC -> WinZip Computing, S.L.)
Task: {301B3852-29EF-4083-A591-DB91A41D5FC4} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [7173848 2016-12-21] (Piriform Ltd -> Piriform Ltd)
Task: {32778F6E-97CB-4297-B02E-5F8B15034EEC} - System32\Tasks\WinZip Update Notifier => C:\Program Files\WinZip\WZUpdateNotifier.exe [1686016 2016-12-13] (WinZip) [File not signed]
Task: {3798C03C-EAB6-433E-9B25-B1EE8BCBD64B} - System32\Tasks\SUPatchForW10Up => C:\ProgramData\Samsung\SamsungUpdatePatch\SUPatchForW10Up.exe [3148800 2015-08-19] (Samsung Electronics CO., LTD.) [File not signed]
Task: {4753AFC3-B839-4444-B870-315BF88FFBFC} - System32\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901} => C:\Program Files\Common Files\AV\Kaspersky Lab\upgrade_launcher.exe [791232 2018-04-11] (Kaspersky Lab -> AO Kaspersky Lab)
Task: {529E05E3-64D8-4ED6-9536-5417A386315A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153752 2016-12-07] (Google Inc -> Google Inc.)
Task: {616E0252-7D89-49A8-BAA7-B0A17C47C30B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153752 2016-12-07] (Google Inc -> Google Inc.)
Task: {6262A3A4-B90C-491D-9C08-F275883E8A1D} - System32\Tasks\bookingDesktopAppUpdateTaskMachineUA => C:\Program Files (x86)\bookingDesktopApp\Update\bookingDesktopAppUpdate.exe [102400 2019-10-23] (bookingDesktopApp.) [File not signed]
Task: {656E419F-115D-4CE5-8E56-B55B27268694} - System32\Tasks\{E7131A0E-5B1C-47A6-89A0-78721EF63AD7} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\EA GAMES\The Sims 2\EAUninstall.exe"
Task: {707E6E5A-36A6-49F1-AD4E-845B8D733286} - System32\Tasks\Mozilla\Firefox Default Browser Agent E7CF176E110C211B => C:\Program Files (x86)\Mozilla Firefox\default-browser-agent.exe [690616 2021-06-02] (Mozilla Corporation -> Mozilla Foundation)
Task: {876572FD-A276-430A-9061-14B219CA2AB0} - System32\Tasks\SCCSpeedBoot => C:\Program Files (x86)\Samsung\Easy Settings\SCCSpeedBoot.exe [3458952 2012-03-28] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.) [File not signed]
Task: {8C25A0A2-AD9D-46CC-98EC-B568B3161A8B} - System32\Tasks\MEGA\MEGAsync Update Task S-1-5-21-3753424090-3426142987-573532147-1000 => C:\Users\User\AppData\Local\MEGAsync\MEGAupdater.exe [1306288 2021-06-13] (Mega Limited -> Mega Limited)
Task: {957D62F1-47BD-4701-A25B-7E91F7C75C89} - System32\Tasks\ReimageUpdater => C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe <==== ATTENTION
Task: {AB20EE5D-4356-44CF-A420-310AB13488EB} - System32\Tasks\Samsung Update Configuration => C:\ProgramData\Samsung\SamsungUpdateConfiguration\ModifyServerRefresh.exe [3440800 2019-03-12] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
Task: {AF9FE4F6-10B9-4726-A124-216FB6B6E41B} - System32\Tasks\{2E0BC5FD-B4CC-4006-992B-EC8288228440} => C:\Windows\system32\pcalua.exe -a "E:\NP700Z5AH\SystemSoftware\USB 3.0 Driver_1.12.5.0\SETUP.EXE" -d "E:\NP700Z5AH\SystemSoftware\USB 3.0 Driver_1.12.5.0"
Task: {B134EA50-6072-47F5-BB8E-19B0512C5313} - System32\Tasks\SAgent => C:\Program Files\Samsung\S Agent\CommonAgent.exe [2982184 2016-02-24] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
Task: {B56E5FC5-0EBB-4896-85C0-C6BD671B0701} - \DriverToolkit Autorun -> No File <==== ATTENTION
Task: {BA685B9F-B105-4B17-8259-B1BF0BA4D85C} - System32\Tasks\EasySpeedUpManager => C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe [1640328 2012-02-01] (Samsung Electronics CO., LTD. -> Samsung Electronics) [File not signed]
Task: {C570EED1-57DE-4B20-8EAC-98B2A4EEE6B4} - System32\Tasks\Opera scheduled assistant Autoupdate 1582725850 => C:\Users\User\AppData\Local\Programs\Opera\launcher.exe [2199760 2021-06-02] (Opera Software AS -> Opera Software) -> --scheduledautoupdate --component-name=assistant --component-path="C:\Users\User\AppData\Local\Programs\Opera\assistant" $(Arg0)
Task: {CC8CDD26-895C-4B75-9E19-A877DB6F73A3} - System32\Tasks\bookingDesktopAppUpdateTaskMachineCore => C:\Program Files (x86)\bookingDesktopApp\Update\bookingDesktopAppUpdate.exe [102400 2019-10-23] (bookingDesktopApp.) [File not signed]
Task: {D1E8F290-03A7-4B23-BE69-79903AA29361} - \GameNet -> No File <==== ATTENTION
Task: {D3309A46-D768-4981-BEE6-884C8D37A0A2} - System32\Tasks\WLANStartup => C:\Program Files (x86)\Samsung\Easy Settings\WLANStartup.exe [1605512 2012-04-04] (Samsung Electronics CO., LTD. -> Samsung Electronics) [File not signed]
Task: {DE0B794C-C631-49DE-8D2E-F35412D248B6} - System32\Tasks\AdobeGCInvoker-1.0 => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [3325520 2020-05-05] (Adobe Inc. -> Adobe Systems, Incorporated)
Task: {E729FE31-BAB8-455C-BFB2-D5A1282BB32A} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe [1112968 2012-05-31] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.) [File not signed]
Task: {EF63F58A-3C3D-4055-B573-6479581A9E5D} - System32\Tasks\AdobeAAMUpdater-1.0-Samsung-User => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508240 2015-08-06] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
Task: {F7CC0139-E744-42C0-BC05-C0F30678E901} - System32\Tasks\MovieColorEnhancer => C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe [784264 2012-04-26] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.) [File not signed]
Task: {F818254A-2023-4378-AB49-F57FE73118DF} - System32\Tasks\Opera scheduled Autoupdate 1533586074 => C:\Users\User\AppData\Local\Programs\Opera\launcher.exe [2199760 2021-06-02] (Opera Software AS -> Opera Software)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 07 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [122128 2015-08-13] (Apple Inc. -> Apple Inc.)
Winsock: Catalog5-x64 07 C:\Program Files\Bonjour\mdnsNSP.dll [133392 2015-08-13] (Apple Inc. -> Apple Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{520E7D35-3140-40A6-B8CA-65A71BB986B6}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{8DDEDDD8-946C-4CFE-92AE-9E7A790A3360}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{B25F2141-4E36-4D64-9CA1-B5564156CE23}: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF DefaultProfile: spi4g6n8.default-1516208365218
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\spi4g6n8.default-1516208365218 [2021-06-16]
FF DownloadDir: Y:\Downloads
FF Homepage: Mozilla\Firefox\Profiles\spi4g6n8.default-1516208365218 -> hxxps://www.yandex.ru/?win=365&clid=2296040
FF Notifications: Mozilla\Firefox\Profiles\spi4g6n8.default-1516208365218 -> hxxps://kametsu.com; hxxps://www.avito.ru
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\spi4g6n8.default-1516208365218\searchplugins\yandex.ru-20185628.xml [2018-12-28]
FF HKLM\...\Firefox\Extensions: [light_plugin_A07576A3CEBC4A72A8CF2C925907DB05@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 18.0.0\FFExt\light_plugin_firefox\addon.xpi
FF Extension: (Kaspersky Protection) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 18.0.0\FFExt\light_plugin_firefox\addon.xpi [2019-05-24]
FF HKLM-x32\...\Firefox\Extensions: [light_plugin_A07576A3CEBC4A72A8CF2C925907DB05@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 18.0.0\FFExt\light_plugin_firefox\addon.xpi
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2017-03-07] (Tracker Software Products (Canada) Ltd -> Tracker Software Products (Canada) Ltd.)
FF Plugin: @videolan.org/vlc,version=3.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-08-07] (Adobe Systems Incorporated -> Adobe Systems)
FF Plugin: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll [2013-12-03] (Adobe Systems Incorporated -> Adobe Systems)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [No File]
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2012-08-09] (Apple Inc. -> )
FF Plugin-x32: @bookingdesktopapp.com/bookingDesktopApp Update;version=3 -> C:\Program Files (x86)\bookingDesktopApp\Update\1.3.99.0\npbookingDesktopAppUpdate3.dll [2019-10-23] (bookingDesktopApp.) [File not signed]
FF Plugin-x32: @bookingdesktopapp.com/bookingDesktopApp Update;version=9 -> C:\Program Files (x86)\bookingDesktopApp\Update\1.3.99.0\npbookingDesktopAppUpdate3.dll [2019-10-23] (bookingDesktopApp.) [File not signed]
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2016-12-10] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2016-12-10] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll [2017-03-07] (Tracker Software Products (Canada) Ltd -> Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2021-05-28] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-08-07] (Adobe Systems Incorporated -> Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll [2013-12-03] (Adobe Systems Incorporated -> Adobe Systems)
FF Plugin HKU\.DEFAULT: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2017-03-07] (Tracker Software Products (Canada) Ltd -> Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-3753424090-3426142987-573532147-1000: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2017-03-07] (Tracker Software Products (Canada) Ltd -> Tracker Software Products (Canada) Ltd.)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\kl_prefs_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.js [2019-05-27] <==== ATTENTION (Points to *.cfg file)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\kl_config_62fbb8f7_c917_4cf7_957a_aad2b8fa768c.cfg [2019-05-27] <==== ATTENTION

Chrome: 
=======
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2021-06-16]
CHR DownloadDir: Y:\Downloads
CHR Notifications: Default -> hxxp://kametsu.com; hxxps://thevideo.me
CHR HomePage: Default -> msn.com
CHR DefaultSearchURL: Default -> hxxps://www.bing.com/search?FORM=__PARAM__DF&PC=__PARAM__&q={searchTerms}
CHR DefaultSearchKeyword: Default -> yandex.ru
CHR DefaultSuggestURL: Default -> hxxps://www.bing.com/osjson.aspx?FORM=__PARAM__DF&PC=__PARAM__&query={searchTerms}
CHR Extension: (Prezentacje) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-13]
CHR Extension: (Dokumenty) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-13]
CHR Extension: (Dysk Google) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2020-10-22]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-08]
CHR Extension: (Tampermonkey) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2021-06-02]
CHR Extension: (Adobe Acrobat) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2021-03-14]
CHR Extension: (MSN Homepage & Bing Search Engine) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcfenmboojpjinhpgggodefccipikbpd [2019-07-28]
CHR Extension: (Arkusze) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-13]
CHR Extension: (Dokumenty Google offline) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2021-05-13]
CHR Extension: (Яндекс) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgdnilodcpljomelbbnpgdogdbmclbni [2020-06-01]
CHR Extension: (Kaspersky Protection 18.0) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\mchjnmdbdlkdbfliogedbnpnanfjnolk [2021-01-27]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-01-29]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2020-10-22]
CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2021-06-07]
CHR HKLM\...\Chrome\Extension: [mchjnmdbdlkdbfliogedbnpnanfjnolk] - hxxps://chrome.google.com/webstore/detail/mchjnmdbdlkdbfliogedbnpnanfjnolk
CHR HKU\S-1-5-21-3753424090-3426142987-573532147-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dhdgffkkebhmkfjojejmpbldmpobfkfo]
CHR HKU\S-1-5-21-3753424090-3426142987-573532147-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKU\S-1-5-21-3753424090-3426142987-573532147-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd]
CHR HKLM-x32\...\Chrome\Extension: [lgdnilodcpljomelbbnpgdogdbmclbni]
CHR HKLM-x32\...\Chrome\Extension: [mchjnmdbdlkdbfliogedbnpnanfjnolk] - hxxps://chrome.google.com/webstore/detail/mchjnmdbdlkdbfliogedbnpnanfjnolk

Opera: 
=======
OPR Profile: C:\Users\User\AppData\Roaming\Opera Software\Opera Stable [2021-06-16]
OPR Notifications: Opera Stable -> hxxps://kametsu.com
OPR StartupUrls: Opera Stable -> "hxxps://www.yandex.ru/?win=365&clid=2296040"
OPR DefaultSuggestURL: Opera Stable -> hxxps://suggest.yandex.ru/suggest-ya.cgi?v=4&part={searchTerms}&l10n={language}
OPR Extension: (Rich Hints Agent) - C:\Users\User\AppData\Roaming\Opera Software\Opera Stable\Extensions\enegjkbbakeegngfapepobipndnebkdk [2021-05-21]
OPR Extension: (SaveFrom.net helper) - C:\Users\User\AppData\Roaming\Opera Software\Opera Stable\Extensions\npdpplbicnmpoigidfdjadamgfkilaak [2021-05-21]

Yandex: 
=======
YAN Profile: C:\Users\User\AppData\Local\Yandex\YandexBrowser\User Data\Default [2018-12-28]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [169672 2021-01-25] (Adobe Inc. -> Adobe Inc.)
R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [3673680 2020-05-05] (Adobe Inc. -> Adobe Systems, Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [3406416 2020-05-05] (Adobe Inc. -> Adobe Systems, Incorporated)
R2 AVP18.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 18.0.0\avp.exe [354672 2017-01-25] (Kaspersky Lab -> AO Kaspersky Lab)
S2 bookingdesktopapp; C:\Program Files (x86)\bookingDesktopApp\Update\bookingDesktopAppUpdate.exe [102400 2019-10-23] (bookingDesktopApp.) [File not signed]
S3 bookingdesktopappm; C:\Program Files (x86)\bookingDesktopApp\Update\bookingDesktopAppUpdate.exe [102400 2019-10-23] (bookingDesktopApp.) [File not signed]
R2 CdRomArbiterService; C:\Program Files\Common Files\cdarbsvc\cdarbsvc_v1.0.0_x64.exe [8704 2019-12-29] (GuinpinSoft inc) [File not signed]
R2 Droid4XService; C:\Program Files (x86)\Droid4X\Droid4XService.exe [285616 2017-08-14] (北京海誉动想科技股份有限公司 -> )
R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2011-09-24] (DISKEEPER CORPORATION -> Diskeeper Corporation)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [8345672 2017-12-07] (GOG Sp. z o.o. -> GOG.com)
R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [190784 2019-08-19] (Huawei Technologies Co., Ltd. -> ) [File not signed]
S3 klvssbridge64_18.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 18.0.0\x64\vssbridge64.exe [424080 2019-05-24] (Kaspersky Lab -> AO Kaspersky Lab)
R2 KSDE2.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 2.0\ksde.exe [354672 2017-01-25] (Kaspersky Lab -> AO Kaspersky Lab)
R2 mi-raysat_3dsmax2012_64; C:\Program Files\Autodesk 3ds max 2012\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe [86016 2011-02-23] () [File not signed]
S3 Origin Client Service; Y:\AppData\orgin\Origin\OriginClientService.exe [2522424 2020-11-20] (Electronic Arts, Inc. -> Electronic Arts)
R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [336824 2010-12-01] (Arvato Digital Services Canada Inc -> arvato digital services llc)
R2 SamsungDeviceConfigurationWinService; C:\Program Files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe [31624 2012-02-14] (Samsung Electronics CO., LTD. -> ) [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-20] (Test Signing Certificate -> Adobe Systems Incorporated) [File not signed]
S3 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3296104 2016-11-09] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Windows -> Microsoft Corporation)
S3 GalaxyClientService; "Y:\AppData\GOG Galaxy\GalaxyClientService.exe" [X]
S2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [X]
S3 WsDrvInst; "C:\Program Files (x86)\Wondershare\Wondershare Video Converter Ultimate\Transfer\DriverInstall.exe" [X]

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ampa; C:\Windows\system32\ampa.sys [38320 2017-02-28] (CHENGDU AOMEI Tech Co., Ltd. -> )
R3 AMPPAL; C:\Windows\System32\DRIVERS\AMPPAL.sys [195584 2011-12-05] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider)
S3 AMPPALP; C:\Windows\System32\DRIVERS\amppal.sys [195584 2011-12-05] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider)
R3 asmthub3; C:\Windows\System32\DRIVERS\asmthub3.sys [130536 2011-11-03] (MCCI Internal Testing Software -> ASMedia Technology Inc)
R3 asmtxhci; C:\Windows\System32\DRIVERS\asmtxhci.sys [395752 2011-11-03] (MCCI Internal Testing Software -> ASMedia Technology Inc)
S3 CEDRIVER60; C:\Program Files (x86)\Cheat Engine 6.7\dbk64.sys [123104 2017-05-30] (Cheat Engine -> )
R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [247008 2016-12-27] (Kaspersky Lab -> AO Kaspersky Lab)
S3 ddmdrv; C:\Windows\system32\ddmdrv.sys [35760 2016-12-27] (CHENGDU AOMEI Tech Co., Ltd. -> )
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2016-12-10] (Disc Soft Ltd -> Disc Soft Ltd)
S3 eprntdrv; C:\Windows\system32\eprntdrv.sys [25992 2019-07-01] (CHENGDU YIWO Tech Development Co., Ltd. -> )
S3 ew_usbccgpfilter; C:\Windows\System32\DRIVERS\ew_usbccgpfilter.sys [18944 2019-08-19] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2011-09-24] (DISKEEPER CORPORATION -> Diskeeper Corporation)
R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [80688 2011-09-24] (DISKEEPER CORPORATION -> Diskeeper Corporation)
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2019-08-19] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
S3 IntcDAud; C:\Windows\System32\DRIVERS\IntcDAud.sys [342528 2000-01-01] (Intel(R) Corporation) [File not signed]
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [554408 2016-10-01] (Kaspersky Lab -> AO Kaspersky Lab)
R0 klbackupdisk; C:\Windows\System32\DRIVERS\klbackupdisk.sys [70880 2017-12-26] (Kaspersky Lab -> AO Kaspersky Lab)
R1 klbackupflt; C:\Windows\System32\DRIVERS\klbackupflt.sys [119608 2019-05-24] (Kaspersky Lab -> AO Kaspersky Lab)
R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [85704 2018-07-24] (Kaspersky Lab -> AO Kaspersky Lab)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [206024 2018-05-08] (Kaspersky Lab -> AO Kaspersky Lab)
R1 KLHK; C:\Windows\System32\DRIVERS\klhk.sys [1093248 2019-05-24] (Kaspersky Lab -> AO Kaspersky Lab)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [1075024 2019-05-24] (Kaspersky Lab -> AO Kaspersky Lab)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [56520 2018-05-08] (Kaspersky Lab -> AO Kaspersky Lab)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [57568 2016-12-23] (Kaspersky Lab -> AO Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [58592 2016-12-07] (Kaspersky Lab -> AO Kaspersky Lab)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [50672 2017-12-26] (Kaspersky Lab -> AO Kaspersky Lab)
R3 kltap; C:\Windows\System32\DRIVERS\kltap.sys [52152 2016-06-07] (AnchorFree Inc -> The OpenVPN Project)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [81904 2017-12-26] (Kaspersky Lab -> AO Kaspersky Lab)
R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [141952 2019-05-24] (Kaspersky Lab -> AO Kaspersky Lab)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [199392 2017-12-26] (Kaspersky Lab -> AO Kaspersky Lab)
R0 pwdrvio; C:\Windows\System32\pwdrvio.sys [19152 2019-05-29] (MiniTool Solution Ltd -> )
S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2019-05-29] (MiniTool Solution Ltd -> )
R1 SABI; C:\Windows\system32\Drivers\SABI.sys [13824 2011-09-23] (Microsoft Windows Hardware Compatibility Publisher -> SAMSUNG ELECTRONICS)
S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [23552 2014-12-01] (Silicon Laboratories) [File not signed]
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [79360 2014-12-01] (Silicon Laboratories) [File not signed]
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-07-09] (Microsoft Windows Hardware Compatibility Publisher -> Apple, Inc.)
R1 YSDrv; C:\Program Files (x86)\Bignox\BigNoxVM\RT\YSDrv.sys [340880 2021-03-25] (Nox Limited -> Nox Limited Corporation)
S3 SWDUMon; system32\DRIVERS\SWDUMon.sys [X]
S3 WacHidRouter; system32\DRIVERS\wachidrouter.sys [X]
S3 wacomrouterfilter; system32\DRIVERS\wacomrouterfilter.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2021-06-16 00:28 - 2021-06-16 00:29 - 000000047 _____ C:\Windows\SysWOW64\config.nt
2021-06-16 00:28 - 2021-06-16 00:28 - 000125952 _____ (Aladdin Knowledge Systems) C:\Windows\SysWOW64\Drivers\hardlock.sys
2021-06-16 00:28 - 2021-06-16 00:28 - 000023040 _____ (Aladdin Knowledge Systems) C:\Windows\SysWOW64\Drivers\aksusb.sys
2021-06-16 00:28 - 2021-06-16 00:28 - 000000988 _____ C:\Users\Public\Desktop\OPTPiX iMageStudio 3.lnk
2021-06-16 00:28 - 2021-06-16 00:28 - 000000988 _____ C:\ProgramData\Desktop\OPTPiX iMageStudio 3.lnk
2021-06-16 00:28 - 2021-06-16 00:28 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OPTPiX iMageStudio 3
2021-06-16 00:28 - 2021-06-16 00:28 - 000000000 ____D C:\Program Files\web technology
2021-06-16 00:09 - 2021-06-16 00:09 - 000001055 _____ C:\Users\User\Desktop\XnView.lnk
2021-06-16 00:09 - 2021-06-16 00:09 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XnView
2021-06-16 00:09 - 2021-06-16 00:09 - 000000000 ____D C:\Program Files (x86)\XnView
2021-06-15 23:01 - 2021-06-15 23:50 - 000000000 ____D C:\Python25
2021-06-15 23:01 - 2021-06-15 23:20 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Python 2.5
2021-06-15 20:17 - 2021-06-15 20:17 - 000004272 _____ C:\Windows\system32\Tasks\Opera scheduled assistant Autoupdate 1582725850
2021-06-02 09:35 - 2021-06-02 09:35 - 000000000 ____D C:\Windows\system32\Tasks\Mozilla
2021-06-02 09:12 - 2021-06-02 17:04 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2021-06-01 13:26 - 2021-06-01 13:51 - 000000000 ____D C:\Users\User\Desktop\Nevan
2021-05-22 22:44 - 2021-05-22 22:44 - 000000724 _____ C:\Users\Public\Desktop\Unity 2018.4.35f1 (64-bit).lnk
2021-05-22 22:44 - 2021-05-22 22:44 - 000000724 _____ C:\ProgramData\Desktop\Unity 2018.4.35f1 (64-bit).lnk
2021-05-22 20:12 - 2021-05-22 22:44 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Unity 2018.4.35f1 (64-bit)
2021-05-20 23:18 - 2021-05-20 23:18 - 000000077 _____ C:\Users\User\Desktop\Unity - Manual- Installing from a registry.url
2021-05-20 23:17 - 2021-05-22 22:53 - 000000000 ____D C:\Users\User\AppData\LocalLow\DefaultCompany
2021-05-20 23:12 - 2021-05-21 09:38 - 000000000 ____D C:\Users\User\New Unity Project
2021-05-20 23:10 - 2021-06-15 20:24 - 000000000 ____D C:\Users\User\AppData\Local\Unity
2021-05-20 23:10 - 2021-05-22 20:20 - 000000000 ____D C:\Users\User\AppData\Roaming\Unity
2021-05-20 23:09 - 2021-05-22 20:12 - 000001356 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Visual Studio Installer.lnk
2021-05-20 23:09 - 2021-05-20 23:09 - 000000000 ____D C:\Users\User\AppData\Roaming\Visual Studio Setup
2021-05-20 23:08 - 2021-05-20 23:08 - 000000000 ____D C:\Program Files (x86)\Microsoft Visual Studio
2021-05-20 23:07 - 2021-05-20 23:07 - 000000000 ____D C:\ProgramData\Microsoft Visual Studio
2021-05-20 23:06 - 2021-05-22 19:32 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Unity 2021.1.7f1 (64-bit)
2021-05-20 21:30 - 2021-06-15 13:17 - 000000000 ____D C:\ProgramData\Unity
2021-05-20 21:28 - 2021-05-22 21:54 - 000000000 ____D C:\Users\User\AppData\Roaming\UnityHub
2021-05-20 21:28 - 2021-05-20 21:28 - 000000000 ____D C:\Users\User\AppData\Roaming\Unity Hub
2021-05-20 21:28 - 2021-05-20 21:28 - 000000000 ____D C:\Users\User\AppData\Local\unityhub-updater
2021-05-20 21:05 - 2021-05-20 21:05 - 000000000 ____D C:\Users\User\AppData\Local\uTinyRipperGUI
2021-05-20 15:10 - 2021-05-22 20:20 - 000000000 ____D C:\Users\User\AppData\LocalLow\Unity
2021-05-20 15:10 - 2021-05-20 15:10 - 000000000 ____D C:\Users\User\AppData\LocalLow\JumpStart
2021-05-20 15:07 - 2021-06-07 15:28 - 000000843 _____ C:\Users\Public\Desktop\School of Dragons.lnk
2021-05-20 15:07 - 2021-06-07 15:28 - 000000843 _____ C:\ProgramData\Desktop\School of Dragons.lnk
2021-05-20 15:07 - 2021-05-20 15:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\School of Dragons

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2021-06-16 13:52 - 2018-04-12 23:23 - 000000000 ____D C:\FRST
2021-06-16 13:11 - 2018-04-11 16:06 - 000000000 ____D C:\ProgramData\Kaspersky Lab
2021-06-16 13:05 - 2009-07-14 07:45 - 000023376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2021-06-16 13:05 - 2009-07-14 07:45 - 000023376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2021-06-16 13:02 - 2017-06-25 17:56 - 000000000 ____D C:\Users\User\Downloads\2010 Adimi Kalbine Yaz (Lossless)
2021-06-16 12:56 - 2019-11-16 20:33 - 000000000 _____ C:\hsrv.txt
2021-06-16 12:56 - 2009-07-14 08:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2021-06-16 09:46 - 2018-07-22 18:48 - 000000000 ____D C:\Users\User\AppData\Local\ChomikBox
2021-06-16 09:13 - 2017-01-04 17:29 - 000000000 ____D C:\Users\User\AppData\LocalLow\Mozilla
2021-06-16 08:09 - 2018-07-22 18:48 - 000000000 ____D C:\Users\User\.gstreamer-0.10
2021-06-16 08:07 - 2016-12-10 15:38 - 000000000 ____D C:\Users\User\AppData\Local\Adobe
2021-06-16 07:59 - 2019-02-15 12:54 - 000000000 ____D C:\ProgramData\Mozilla
2021-06-16 00:28 - 2009-07-14 06:20 - 000000000 ____D C:\Windows\inf
2021-06-16 00:23 - 2016-12-08 17:12 - 1683881984 _____ C:\Users\User\AppData\Local\SageThumbs.db3
2021-06-16 00:15 - 2017-07-19 18:29 - 000000000 ____D C:\Users\User\AppData\Roaming\XnView
2021-06-15 22:34 - 2016-12-15 21:33 - 000000000 ____D C:\Users\User\AppData\Roaming\uTorrent
2021-06-15 22:26 - 2019-06-30 07:35 - 000000000 ____D C:\Users\User\AppData\Local\BitTorrentHelper
2021-06-15 20:12 - 2021-04-15 15:28 - 000001446 _____ C:\Users\User\Desktop\Zainstaluj Kaspersky VPN Secure Connection w wersji 21.3.10.391.lnk
2021-06-15 08:42 - 2016-12-07 21:58 - 000002230 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2021-06-14 23:32 - 2019-09-06 13:06 - 000000000 ____D C:\Users\User\Desktop\New folder (22)
2021-06-14 22:07 - 2020-07-04 22:09 - 000000000 ____D C:\Users\User\Desktop\New folder (19)
2021-06-13 10:29 - 2019-11-12 13:59 - 000000000 ____D C:\Users\User\AppData\Local\MEGAsync
2021-06-12 12:19 - 2019-03-02 15:28 - 839264722 _____ C:\Windows\MEMORY.DMP
2021-06-12 11:18 - 2017-01-22 16:25 - 000002059 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2021-06-12 11:08 - 2019-10-04 10:35 - 000000000 ___HD C:\Users\Public\Documents\AdobeGCData
2021-06-12 11:08 - 2019-10-04 10:35 - 000000000 ___HD C:\ProgramData\Documents\AdobeGCData
2021-06-09 13:22 - 2009-07-14 08:08 - 000032592 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2021-06-08 15:41 - 2019-09-12 11:18 - 000001118 _____ C:\Users\User\Desktop\4G Wi-Fi modem.lnk
2021-06-08 10:00 - 2009-07-14 08:13 - 000781790 _____ C:\Windows\system32\PerfStringBackup.INI
2021-06-06 20:01 - 2021-02-13 20:10 - 000000300 _____ C:\Users\User\d4ac4633ebd6440fa397b84f1bc94a3c.7z
2021-06-06 20:01 - 2018-12-20 16:21 - 000000000 ____D C:\Users\User\AppData\Local\Nox
2021-06-06 19:44 - 2021-03-25 20:55 - 000000000 ____D C:\Users\User\.BigNox
2021-06-06 19:44 - 2019-10-23 16:14 - 000000000 ____D C:\Users\User\AppData\Local\NoxSrv
2021-06-06 19:44 - 2018-12-20 16:23 - 000000000 ____D C:\Users\User\vmlogs
2021-06-06 19:44 - 2017-03-08 12:39 - 000000000 ____D C:\Users\User\.android
2021-06-03 13:54 - 2020-07-30 09:43 - 000004082 _____ C:\Windows\system32\Tasks\Opera scheduled Autoupdate 1533586074
2021-06-02 22:27 - 2017-02-19 22:30 - 000000132 _____ C:\Users\User\AppData\Roaming\Adobe PNG Format CS6 Prefs
2021-06-02 17:04 - 2017-01-04 17:28 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2021-05-29 20:55 - 2016-12-10 15:09 - 000000000 ____D C:\ProgramData\boost_interprocess
2021-05-28 22:22 - 2020-07-14 20:53 - 000000000 ____D C:\Users\User\Desktop\New folder (21)
2021-05-24 12:24 - 2016-12-07 14:04 - 000000000 ____D C:\Windows\Minidump
2021-05-21 10:37 - 2016-12-09 21:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
2021-05-21 10:32 - 2018-08-14 21:06 - 000000000 ____D C:\Users\User\AppData\Local\Bluestacks
2021-05-20 20:51 - 2016-12-09 20:28 - 000774404 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

==================== Files in the root of some directories ========

2020-07-02 21:12 - 2020-07-02 21:12 - 000000171 _____ () C:\Users\User\AppData\Roaming\822f02e4-9e9a-4077-a765-71edfca16ad0
2018-03-25 12:26 - 2018-03-25 12:26 - 000000132 _____ () C:\Users\User\AppData\Roaming\Adobe BMP Format CS6 Prefs
2017-03-08 09:51 - 2017-03-08 09:52 - 000000132 _____ () C:\Users\User\AppData\Roaming\Adobe GIF Format CS6 Prefs
2016-12-26 01:13 - 2018-02-23 14:25 - 000000132 _____ () C:\Users\User\AppData\Roaming\Adobe OpenEXR Format CS6 Prefs
2017-02-19 22:30 - 2021-06-02 22:27 - 000000132 _____ () C:\Users\User\AppData\Roaming\Adobe PNG Format CS6 Prefs
2016-12-26 23:16 - 2020-10-30 20:56 - 000000132 _____ () C:\Users\User\AppData\Roaming\Adobe Targa Format CS6 Prefs
2018-12-20 16:09 - 2019-11-16 20:33 - 000002432 _____ () C:\Users\User\AppData\Roaming\droid4xinstaller.log
2018-04-18 11:58 - 2020-04-09 18:39 - 000009728 _____ () C:\Users\User\AppData\Roaming\Launcher_01.exe
2016-12-12 11:14 - 2016-12-12 11:14 - 000000100 _____ () C:\Users\User\AppData\Roaming\ScriptStudioLayout.ini
2016-12-12 11:14 - 2016-12-12 11:14 - 000000046 _____ () C:\Users\User\AppData\Roaming\ScriptStudioOptions.ini
2018-08-12 16:33 - 2018-08-12 16:33 - 000001456 _____ () C:\Users\User\AppData\Local\Adobe Save for Web 13.0 Prefs
2019-01-30 21:49 - 2019-01-30 21:49 - 000000831 _____ () C:\Users\User\AppData\Local\Nox_crash.log
2018-09-28 17:29 - 2018-09-28 17:29 - 000000000 _____ () C:\Users\User\AppData\Local\oobelibMkey.log
2017-01-05 12:36 - 2017-03-30 12:12 - 000000009 _____ () C:\Users\User\AppData\Local\OrnatrixMayaLicenseServerIP.txt
2017-01-05 12:31 - 2017-03-25 17:42 - 000000076 _____ () C:\Users\User\AppData\Local\OrnatrixMayaSetupFilepath.txt
2016-12-08 09:06 - 2017-01-27 18:12 - 000007609 _____ () C:\Users\User\AppData\Local\resmon.resmoncfg
2016-12-08 17:12 - 2021-06-16 00:23 - 1683881984 _____ () C:\Users\User\AppData\Local\SageThumbs.db3
2021-01-02 22:13 - 2021-01-02 22:30 - 000000068 _____ () C:\Users\User\AppData\Local\update_progress.txt
2020-11-06 13:40 - 2020-11-06 13:40 - 000000000 _____ () C:\Users\User\AppData\Local\{3B1F60CB-42EB-4C19-A4E6-DA47273C6404}
2020-05-27 20:57 - 2020-05-27 20:57 - 000000000 _____ () C:\Users\User\AppData\Local\{575ED654-5A93-43A3-9D52-0F70A4A7CD96}
2021-02-09 18:15 - 2021-02-09 18:15 - 000000000 _____ () C:\Users\User\AppData\Local\{5FE370DA-10E7-46C6-9968-CA29758AECBF}
2020-02-15 21:01 - 2020-02-15 21:01 - 000000000 _____ () C:\Users\User\AppData\Local\{911E1CCB-17AD-4723-BEF2-7A019ABB02ED}
2020-11-06 13:40 - 2020-11-06 13:40 - 000000000 _____ () C:\Users\User\AppData\Local\{9B393401-DC92-414B-A417-706FA6041CFB}
2021-02-09 18:15 - 2021-02-09 18:15 - 000000000 _____ () C:\Users\User\AppData\Local\{E0A0EA9C-C948-431F-BFD3-A8E08900A708}

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)



ATTENTION: ==> Could not access BCD.  -> 

LastRegBack: 2021-06-16 10:48
==================== End of FRST.txt ========================