begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
SetServiceStart('ingeService', 4);
QuarantineFile('c:\windows\data\hvault.exe', '');
QuarantineFile('c:\windows\svhost.exe', '');
DeleteFile('c:\windows\data\hvault.exe', '32');
DeleteFile('C:\Windows\svhost.exe', '32');
DeleteFile('C:\Windows\svhost.exe', '64');
DeleteService('ingeService');
BC_ImportALL;
ExecuteSysClean;
ExecuteWizard('SCU', 2, 3, true);
BC_Activate;
RebootWindows(true);
end.begin
DeleteFile(GetAVZDirectory+'quarantine.7z');
ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pmalware quarantine .\Quarantine\*', 1, 300000, false);
end.O22 - Task: (damaged) C:\Windows\System32\Tasks\Hewlett-Packard\HP Support Assistant (empty)
O22 - Tasks: (damaged) \Microsoft\Windows\Application Experience\MareBackup - C:\Windows\system32\compattelrunner.exe -m:aemarebackup.dll -f:BackupMareData (user missing) (sign: 'Microsoft')
O22 - Tasks: (damaged) \Microsoft\Windows\Application Experience\MareBackup - C:\Windows\system32\compattelrunner.exe -m:appraiser.dll -f:DoScheduledTelemetryRun (user missing) (sign: 'Microsoft')
O26 - Debugger: HKLM\..\FF_.exe: [Debugger] = 0 (file missing)
O26 - Debugger: HKLM\..\KMPlayer.exe: [Debugger] = 0 (file missing)отправил, имя:
сделал, новые логи прикладываю
Start::
SystemRestore: On
CreateRestorePoint:
HKLM\...\Run: [AdobeGCInvoker-1.0] => "C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe" (Нет файла)
Policies: C:\ProgramData\NTUSER.pol: Ограничение <==== ВНИМАНИЕ
2023-12-22 21:33 - 2023-12-24 02:40 - 000000000 ____D C:\Windows\data
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat DC.lnk:1069064143 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller DC.lnk:9185529B88 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop 2023.lnk:4A503CCB3B [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ahk2Exe.lnk:0676F50C01 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoHotkey Dash.lnk:B4B3884CBE [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoHotkey Window Spy.lnk:88F1223DAF [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini:41964AA945 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk:8096E45125 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Immersive Control Panel.lnk:DC8F23BC3A [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++.lnk:159ADC9AA1 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote.lnk:60EC9648C0 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outline.lnk:9602C26DD5 [3442]
FirewallRules: [TCP Query User{5DDE1C98-F488-41FB-9779-74CAC7305FF9}C:\program files\riot games\riot client\riotclientservices.exe] => (Allow) C:\program files\riot games\riot client\riotclientservices.exe => Нет файла
FirewallRules: [UDP Query User{FF849851-3474-4D95-8DF7-94A9FC1681F0}C:\program files\riot games\riot client\riotclientservices.exe] => (Allow) C:\program files\riot games\riot client\riotclientservices.exe => Нет файла
FirewallRules: [TCP Query User{4268066F-4D3E-4F1A-89DA-8AF63181751B}C:\games\just cause 4\justcause4.exe] => (Allow) C:\games\just cause 4\justcause4.exe => Нет файла
FirewallRules: [UDP Query User{EFBDA170-2B41-497B-844D-C8C9D51B17ED}C:\games\just cause 4\justcause4.exe] => (Allow) C:\games\just cause 4\justcause4.exe => Нет файла
FirewallRules: [TCP Query User{ACA489B9-275F-4830-B94D-7E52DFFE4068}C:\users\user\appdata\roaming\.tlauncher\jvms\jre1.8.0_281\bin\javaw.exe] => (Allow) C:\users\user\appdata\roaming\.tlauncher\jvms\jre1.8.0_281\bin\javaw.exe => Нет файла
FirewallRules: [UDP Query User{C5F5C070-1B00-4EEF-811C-4C5B84A01226}C:\users\user\appdata\roaming\.tlauncher\jvms\jre1.8.0_281\bin\javaw.exe] => (Allow) C:\users\user\appdata\roaming\.tlauncher\jvms\jre1.8.0_281\bin\javaw.exe => Нет файла
FirewallRules: [TCP Query User{468BA2C5-CEF4-4494-A847-2121810002DE}C:\users\user\appdata\roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\bin\javaw.exe] => (Block) C:\users\user\appdata\roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\bin\javaw.exe => Нет файла
FirewallRules: [UDP Query User{41ADF0F4-82FA-4AD2-A581-E5A18EDF188B}C:\users\user\appdata\roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\bin\javaw.exe] => (Block) C:\users\user\appdata\roaming\.minecraft\runtime\java-runtime-gamma\windows\java-runtime-gamma\bin\javaw.exe => Нет файла
FirewallRules: [TCP Query User{2BE4AE98-2B1F-4429-BEB0-3A0F17012C29}C:\games\the last of us part i-insaneramzes\tlou-i.exe] => (Allow) C:\games\the last of us part i-insaneramzes\tlou-i.exe => Нет файла
FirewallRules: [UDP Query User{C760CD53-A6A4-46E9-A71B-F129A28FE649}C:\games\the last of us part i-insaneramzes\tlou-i.exe] => (Allow) C:\games\the last of us part i-insaneramzes\tlou-i.exe => Нет файла
FirewallRules: [TCP Query User{48291A18-0C69-4E84-AED6-2EFDDE9A56E1}C:\program files (x86)\hogwarts legacy\phoenix\binaries\win64\hogwartslegacy.exe] => (Allow) C:\program files (x86)\hogwarts legacy\phoenix\binaries\win64\hogwartslegacy.exe => Нет файла
FirewallRules: [UDP Query User{95606734-26FF-48F1-AF2F-79484D647585}C:\program files (x86)\hogwarts legacy\phoenix\binaries\win64\hogwartslegacy.exe] => (Allow) C:\program files (x86)\hogwarts legacy\phoenix\binaries\win64\hogwartslegacy.exe => Нет файла
FirewallRules: [TCP Query User{D9F6F8BD-D95E-442E-96DC-1AFA7FB85FD2}C:\games\ghostrunner 2 (2023)\ghostrunner 2\ghostrunner2\binaries\win64\ghostrunner2-win64-shipping.exe] => (Allow) C:\games\ghostrunner 2 (2023)\ghostrunner 2\ghostrunner2\binaries\win64\ghostrunner2-win64-shipping.exe => Нет файла
FirewallRules: [UDP Query User{479DC058-B7F8-475C-AD1D-BCDA546E70FA}C:\games\ghostrunner 2 (2023)\ghostrunner 2\ghostrunner2\binaries\win64\ghostrunner2-win64-shipping.exe] => (Allow) C:\games\ghostrunner 2 (2023)\ghostrunner 2\ghostrunner2\binaries\win64\ghostrunner2-win64-shipping.exe => Нет файла
FirewallRules: [TCP Query User{C918F95D-5258-48A5-A765-50E88367C6B0}C:\games\lords of the fallen (2023)\lords of the fallen\lotf2\binaries\win64\lotf2-win64-shipping.exe] => (Block) C:\games\lords of the fallen (2023)\lords of the fallen\lotf2\binaries\win64\lotf2-win64-shipping.exe => Нет файла
FirewallRules: [UDP Query User{407CD594-25B5-4D40-87A9-197614EC4C49}C:\games\lords of the fallen (2023)\lords of the fallen\lotf2\binaries\win64\lotf2-win64-shipping.exe] => (Block) C:\games\lords of the fallen (2023)\lords of the fallen\lotf2\binaries\win64\lotf2-win64-shipping.exe => Нет файла
FirewallRules: [TCP Query User{AB7A7EFC-F8E8-4656-8641-36EA4D6754C3}C:\games\atlas fallen (2023)\atlas fallen\bin\atlasfallen (vk).exe] => (Allow) C:\games\atlas fallen (2023)\atlas fallen\bin\atlasfallen (vk).exe => Нет файла
FirewallRules: [UDP Query User{62FD3756-20FD-44BB-BB73-A21A89857BB5}C:\games\atlas fallen (2023)\atlas fallen\bin\atlasfallen (vk).exe] => (Allow) C:\games\atlas fallen (2023)\atlas fallen\bin\atlasfallen (vk).exe => Нет файла
EmptyTemp:
Reboot:
End::
офигеть, а не подскажете когда я подхватил вирус, не на днях ли случаем?
Спасибо огромное, у меня сейчас каждый раз при запуске блокнот открывается, как убрать это?
Выделите следующий код:
Start::
HKLM\...\Run: [] => [X]
CMD: attrib.exe +S +H "%APPDATA%\Microsoft\Windows\Start Menu\desktop.ini" /S
End::Вроде да исправлена, Спасибо большущее
