begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
QuarantineFile('C:\Program Files (x86)\HReuCWjxaimU2\toJqgzPTUKYhl.dll', '');
QuarantineFile('C:\Program Files (x86)\KypIUqUeagMswzwjgbR\NmuFTdI.dll', '');
QuarantineFile('C:\Program Files (x86)\WctMgKafU\oqzTKh.dll', '');
QuarantineFile('C:\Program Files (x86)\ZPSkSQzenpoLC\OKgvlxt.dll', '');
QuarantineFile('C:\ProgramData\rAufNpqofmFSUTVB\gASVKEe.wsf^', '');
QuarantineFile('C:\Users\SURIK\AppData\Local\Programs\ivanovsasha224\c6c3a5a87b.msi', '');
DeleteFile('C:\Program Files (x86)\HReuCWjxaimU2\toJqgzPTUKYhl.dll', '64');
DeleteFile('C:\Program Files (x86)\KypIUqUeagMswzwjgbR\NmuFTdI.dll', '64');
DeleteFile('C:\Program Files (x86)\WctMgKafU\oqzTKh.dll', '64');
DeleteFile('C:\Program Files (x86)\ZPSkSQzenpoLC\OKgvlxt.dll', '64');
DeleteFile('C:\ProgramData\rAufNpqofmFSUTVB\gASVKEe.wsf^', '64');
DeleteSchedulerTask('EryxZUHalDzju2');
DeleteSchedulerTask('jVlIUJSAWIPJMw');
DeleteSchedulerTask('NQCzxjgVtIAmjXypK2');
DeleteSchedulerTask('TTuukJTJTLhTXCotaUd2');
DeleteSchedulerTask('ypsuZJSHIeBMQrL2');
BC_ImportALL;
ExecuteSysClean;
ExecuteWizard('SCU', 2, 3, true);
BC_Activate;
RebootWindows(true);
end.begin
DeleteFile(GetAVZDirectory+'quarantine.7z');
ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pmalware quarantine .\Quarantine\*', 1, 300000, false);
end.O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Doctor Web (empty)
То есть, прикрепите новый CollectionLog.
Будут сопротивляться, удалите принудительно через Geek Uninstaller
begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
ClearQuarantineEx(true);
QuarantineFile('C:\Users\SURIK\AppData\Local\Programs\Transmission\Qt5Core.dll', '');
DeleteFile('C:\Users\SURIK\AppData\Local\Programs\Transmission\Qt5Core.dll', '');
DeleteFileMask('c:\users\surik\appdata\local\programs\transmission', '*', false);
DeleteDirectory('c:\users\surik\appdata\local\programs\transmission');
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
ExecuteSysClean;
ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.Этот ещё покажите, пожалуйста.
Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
GroupPolicy: Ограничение - Chrome <==== ВНИМАНИЕ
Policies: C:\ProgramData\NTUSER.pol: Ограничение <==== ВНИМАНИЕ
HKLM\SOFTWARE\Policies\Google: Ограничение <==== ВНИМАНИЕ
HKLM\SOFTWARE\Policies\Microsoft\Edge: Ограничение <==== ВНИМАНИЕ
Task: {E0634B86-CDB6-4B1C-B2B8-FD101B50517D} - System32\Tasks\AdLock Update Task-S-1-5-21-296519572-1384453368-1023087669-1001 => C:\WINDOWS\System32\msiexec.exe [212992 2022-11-11] (Microsoft Windows -> Microsoft Corporation) -> /i "C:\Users\SURIK\AppData\Local\Programs\ivanovsasha224\c6c3a5a87b.msi" /quiet CHROME=1
C:\Users\SURIK\AppData\Local\Programs\ivanovsasha224\c6c3a5a87b.msi
Edge DefaultSearchURL: Default -> hxxp://search-cdn.net/fip/?q={searchTerms}
Edge DefaultSearchKeyword: Default -> cdn
CHR StartupUrls: Default -> "hxxps://www.google.com/", "hxxps://www.google.com/"
CHR DefaultSearchKeyword: Default -> cdn
C:\Users\SURIK\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhkbfkkohcdgpckffakhbllifkakihmh
CHR HKU\S-1-5-21-296519572-1384453368-1023087669-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [gndelhfhcfbdhndfpcinebijfcjpmpec]
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]
C:\Users\SURIK\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions\aegnopegbbhjeeiganiajffnalhlkkjb
C:\Users\SURIK\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 1\Extensions\aegnopegbbhjeeiganiajffnalhlkkjb
S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]
2023-06-14 07:11 C:\ProgramData\RDP Wrapper
AdBlock Shield 1.0.0.0 (HKU\S-1-5-21-296519572-1384453368-1023087669-1001\...\{f8d3737a-6606-469c-9a33-a7919a86262b}) (Version: 1.0.0.0 - ivanovsasha224) Hidden
AlternateDataStreams: C:\ProgramData\TEMP:D8999815 [402]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [9192]
AlternateDataStreams: C:\Users\SURIK\Application Data:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\SURIK\AppData\Roaming:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\SURIK\AppData\Local\Temp:$DATA [16]
FirewallRules: [{BED88BE2-4D26-43B2-9EA9-6CCA55D8A770}] => (Allow) 㩃啜敳獲卜剕䭉䅜灰慄慴剜慯業杮瑜捯䱜畊ぢ攮數 => Нет файла
FirewallRules: [{FA3CF395-9237-47BC-88CF-FB8FDBFD7FB8}] => (Allow) 㩃啜敳獲卜剕䭉䅜灰慄慴剜慯業杮瑜捯捜牨浯摥楲敶硥e => Нет файла
FirewallRules: [{EAA3DEF6-E215-40B5-9027-63A764AD2F3D}] => (Allow) 㩃啜敳獲卜剕䭉䅜灰慄慴剜慯業杮瑜捯䍜牨浯履灁汰捩瑡潩屮桃潲敭攮數 => Нет файла
FirewallRules: [{42974E2C-4D89-4700-9837-39F62FC50FFC}] => (Allow) 㩃啜敳獲卜剕䭉䅜灰慄慴剜慯業杮瑜捯卜㌵⸸硥e => Нет файла
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyTemp:
Reboot:
End::Удалите.
