Решена Майнер TCP dialer.exe

begin
 QuarantineFile('C:\Users\Anastasi\AppData\Roaming\utorrent\UtorrentWeb.exe', '');
 DeleteFile('C:\Users\Anastasi\AppData\Roaming\utorrent\UtorrentWeb.exe', '64');
 DeleteSchedulerTask('UpdateTorrent');
ExecuteSysClean;
 ExecuteWizard('TSW', 2, 3, true);
end.

begin
 CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
end.

Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
Unlock: C:\FRST\
RemoveProxy:
C:\Users\Anastasi\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\dkhmcfillejahminclclcnemkoobhomk
CHR HKU\S-1-5-21-3055864406-2134651979-2748375454-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pchfckkccldkbclgdepkaonamkignanh]
C:\Users\Anastasi\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extensions\imcbcfifeggclnldhcgpmedffmhkidic
S2 BITS_bkp; C:\WINDOWS\System32\qmgr.dll [1474560 2025-11-14] (Microsoft Windows -> Microsoft Corporation)
2025-08-30 18:23 - 2025-11-23 21:03 - 000000000 ____D C:\ProgramData\yzksdkbakpnl
2025-08-30 18:23 - 2025-10-09 17:28 - 000000000 ____D C:\Users\Anastasi\AppData\Local\MSfree Inc
StartPowershell:
Remove-MpPreference -ExclusionExtension ".exe"
Remove-MpPreference -ExclusionPath "C:\ProgramData"
Remove-MpPreference -ExclusionPath "C:\Users\Anastasi"
Remove-MpPreference -ExclusionPath "C:\WINDOWS\system32\config\systemprofile"
Remove-MpPreference -ExclusionPath "C:"
Set-MpPreference -DisableAutoExclusions $true -Force
Set-MpPreference -Mapsreporting basic -Force
Set-MpPreference -DisableArchiveScanning $false -Force
Set-MpPreference -DisableBehaviorMonitoring $false -Force
Set-MpPreference -DisableRealtimeMonitoring $false -Force
Set-MpPreference -DisablePrivacyMode $true -Force
Set-MpPreference -DisableIOAVProtection $false -Force
Set-MpPreference -UILockdown 0
Set-MpPreference -ScanPurgeItemsAfterDelay 1
Set-MpPreference -CheckForSignaturesBeforeRunningScan $true -Force
Set-MpPreference -PUAProtection enabled -Force
Update-MpSignature
Get-MpComputerStatus
Get-MpPreference
Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage
Get-AppxPackage Microsoft.SecHealthUI -AllUsers|select Name, Status
EndPowerShell:
Reg: reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules C:\Firewall.reg
C:\Firewall.reg
CMD: netsh advfirewall reset
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyEventLogs:
EmptyTemp:
Reboot:
End::