У меня есть только безопасный режим, безопасный режим с загрузкой сетевых драйверов и безопасный режим с поддержкой командной строки. Что мне выбрать?
Извините, теперь всё понял. Вот собранные логи и два репорта на всякий случай
AdLock Privacy Ad Blocker 1.0.0.0 [2022/09/19 13:44:55]-->"C:\Users\1\AppData\Local\Package Cache\{14d63e72-64d4-4a60-87c0-5b150ca2a1c4}\setup-win32-bundle.exe" /uninstallO2-32 - HKLM\..\BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.0.36\IPS\IPSBHO.DLL (file missing)
O4 - HKCU\..\RunOnce: [Application Restart #1] = C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe "C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe" "C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe" "C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe" -Embedding (file missing)
O4 - HKLM\..\Run: [Realtek HD Audio] = C:\ProgramData\ReaItekHD\taskhostw.exe (file missing)
O17 - DHCP DNS 1: 45.95.11.175
O17 - DHCP DNS 2: 178.175.133.61
O17 - HKLM\System\CCS\Services\Tcpip\..\{58AE96FE-4841-4812-9A23-C826AC7F34D0}: [NameServer] = 178.175.133.61
O17 - HKLM\System\CCS\Services\Tcpip\..\{58AE96FE-4841-4812-9A23-C826AC7F34D0}: [NameServer] = 45.95.11.175
O22 - Task (.job): (Ready) AcFXfPsXuTUaXxoyR.job - C:\WINDOWS\Temp\gybTfrXmDqtpphMP\loKECwcFRujPTJZ\fqkzyYF.exe (file missing)
O22 - Tasks: (disabled) \Microsoft\Windows\Workplace Join\Automatic-Workplace-Join - C:\WINDOWS\System32\AutoWorkplace.exe join (file missing)
O22 - Tasks: (telemetry) \Microsoft\Office\Office 15 Subscription Heartbeat - C:\Program Files\Common Files\Microsoft Shared\Office16\OLicenseHeartbeat.exe (file missing)
O22 - Tasks: \Microsoft\Windows\WindowsBackup\OnlogonCheck - C:\Programdata\ReaItekHD\taskhostw.exe (file missing)
O22 - Tasks: \Microsoft\Windows\WindowsBackup\RealtekCheck - C:\Programdata\ReaItekHD\taskhost.exe (file missing)
O22 - Tasks: \Microsoft\Windows\WindowsBackup\TaskCheck - C:\Programdata\ReaItekHD\taskhostw.exe (file missing)
O22 - Tasks: \Microsoft\Windows\WindowsBackup\WinlogonCheck - C:\Programdata\ReaItekHD\taskhost.exe (file missing)
O22 - Tasks: AcFXfPsXuTUaXxoyR - C:\WINDOWS\Temp\gybTfrXmDqtpphMP\loKECwcFRujPTJZ\fqkzyYF.exe Zd /site_id 690689 /S (file missing)
O22 - Tasks: ByteFence - C:\Program Files\ByteFence\ByteFence.exe /a (file missing)
O22 - Tasks: Opera scheduled assistant Autoupdate 1607279145 - C:\Users\1\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate --component-name=assistant --component-path="C:\Users\1\AppData\Local\Programs\Opera\assistant" $(Arg0) (file missing)
O22 - Tasks: Opera scheduled Autoupdate 1607279017 - C:\Users\1\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (file missing)
O22 - Tasks_Migrated: (disabled) \Microsoft\Windows\Workplace Join\Automatic-Workplace-Join - C:\WINDOWS\System32\AutoWorkplace.exe join (file missing)
O22 - Tasks_Migrated: (telemetry) \Microsoft\Office\Office 15 Subscription Heartbeat - C:\Program Files\Common Files\Microsoft Shared\Office16\OLicenseHeartbeat.exe (file missing)
O22 - Tasks_Migrated: \Microsoft\Windows\Diagnosis\RecommendedTroubleshootingScanner - C:\WINDOWS\system32\mitigationscanner.exe (file missing)
O22 - Tasks_Migrated: AcFXfPsXuTUaXxoyR - C:\WINDOWS\Temp\gybTfrXmDqtpphMP\loKECwcFRujPTJZ\fqkzyYF.exe Zd /site_id 690689 /S (file missing)
O22 - Tasks_Migrated: ByteFence - C:\Program Files\ByteFence\ByteFence.exe /a (file missing)
O22 - Tasks_Migrated: Opera scheduled assistant Autoupdate 1607279145 - C:\Users\1\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate --component-name=assistant --component-path="C:\Users\1\AppData\Local\Programs\Opera\assistant" $(Arg0) (file missing)
O22 - Tasks_Migrated: Opera scheduled Autoupdate 1607279017 - C:\Users\1\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (file missing)Скорее всего она скрыта. @rostislavneshta, пропустите этот шаг, разберёмся с ней позже.
У меня видны скрытые папки, я уже деинсталлировал. Сейчас разбираюсь с пунктом 3. Скажите пожалуйста, обязательно сбрасывать роутер до заводских и менять пароль? Просто есть некоторые проблемы с этим
у вас там троянские DNS прописаны. Весь ваш трафик идёт через сервера злодея.
Что не сможете удалить стандартно, удалите принудительно через Geek Uninstaller
begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
ClearQuarantineEx(true);
TerminateProcessByName('c:\programdata\protein-portal\bin.exe');
QuarantineFile('C:\Program Files (x86)\EzmLRlSUU\bSLgiU.dll', '');
QuarantineFile('C:\Program Files (x86)\ljyEVpUktkuHC\LcKYxad.dll', '');
QuarantineFile('C:\Program Files (x86)\OzcsNlKmRLtHBgsspDR\UFuIKsH.dll', '');
QuarantineFile('C:\Program Files (x86)\yDpLHcmLKVMU2\rbbSjLCgMicUg.dll', '');
QuarantineFile('C:\ProgramData\bvWGyQdfUEAlzkVB\yoewBVN.wsf', '');
QuarantineFile('c:\programdata\protein-portal\bin.exe', '');
QuarantineFile('C:\Users\1\AppData\Local\Programs\AdLock\61dcb64cb9.msi', '');
DeleteSchedulerTask('AdLock Update Task-S-1-5-21-3974668594-2224087302-1890559084-1002');
DeleteSchedulerTask('BtDtlUdOnWxDu2');
DeleteSchedulerTask('Microsoft\Windows\SMB\UninstallSMB1ClientTask');
DeleteSchedulerTask('Microsoft\Windows\SMB\UninstallSMB1ServerTask');
DeleteSchedulerTask('MOwMSWJuzNYujC');
DeleteSchedulerTask('PclJyMJxQJTGjmijV2');
DeleteSchedulerTask('poland-poll');
DeleteSchedulerTask('RZSxKSTidhsHFjtmNvP2');
DeleteSchedulerTask('zBotWVnKzFxRpkN2');
DeleteFile('C:\Program Files (x86)\EzmLRlSUU\bSLgiU.dll', '64');
DeleteFile('C:\Program Files (x86)\ljyEVpUktkuHC\LcKYxad.dll', '64');
DeleteFile('C:\Program Files (x86)\OzcsNlKmRLtHBgsspDR\UFuIKsH.dll', '64');
DeleteFile('C:\Program Files (x86)\yDpLHcmLKVMU2\rbbSjLCgMicUg.dll', '64');
DeleteFile('C:\ProgramData\bvWGyQdfUEAlzkVB\yoewBVN.wsf', '64');
DeleteFile('c:\programdata\protein-portal\bin.exe', '');
DeleteFile('C:\ProgramData\protein-portal\bin.exe', '64');
DeleteFile('C:\Users\1\AppData\Local\Programs\AdLock\61dcb64cb9.msi', '64');
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
ExecuteSysClean;
ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
GroupPolicy: Ограничение - Chrome <==== ВНИМАНИЕ
Policies: C:\ProgramData\NTUSER.pol: Ограничение <==== ВНИМАНИЕ
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ограничение <==== ВНИМАНИЕ
HKLM\SOFTWARE\Policies\Google: Ограничение <==== ВНИМАНИЕ
Task: {5D4E5CDB-22F9-46CB-AC00-DAF410DB04FF} - \Microsoft\Windows\Setup\EOSNotify2 -> Нет файла <==== ВНИМАНИЕ
Task: {6CF72C50-86EE-47B3-95A0-522EB5FC4414} - \Microsoft\Windows\Setup\EOSNotify -> Нет файла <==== ВНИМАНИЕ
CHR Notifications: Default -> hxxps://best-loan-info.com; hxxps://ccleaner-download.xyz; hxxps://mail-notification.info; hxxps://mnthor.xyz; hxxps://pinghauz.xyz; hxxps://s-tracking.xyz; hxxps://supertopfreegames.com; hxxps://zarabotok-online.xyz
CHR HomePage: Guest Profile -> hxxps://find-it.pro/?utm_source=distr_m
CHR StartupUrls: Guest Profile -> "hxxps://find-it.pro/?utm_source=distr_m"
CHR DefaultSearchKeyword: Guest Profile -> cdn
C:\Users\1\AppData\Local\Google\Chrome\User Data\Guest Profile\Extensions\meejmcfbiapijdfaadackoblffmidlig
CHR HomePage: System Profile -> hxxps://find-it.pro/?utm_source=distr_m
CHR StartupUrls: System Profile -> "hxxps://find-it.pro/?utm_source=distr_m"
CHR DefaultSearchKeyword: System Profile -> cdn
C:\Users\1\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\meejmcfbiapijdfaadackoblffmidlig
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.0.36\Exts\Chrome.crx <не найдено>
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyTemp:
Reboot:
End::
