Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
Unlock: C:\FRST\
RemoveProxy:
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ограничение <==== ВНИМАНИЕ
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center: Ограничение <==== ВНИМАНИЕ
HKLM\SYSTEM\...\Terminal Server: [fDenyTSConnections] = 0 <==== ВНИМАНИЕ
HKU\S-1-5-21-1024298590-4001146404-2967232784-1001\...\Policies\Explorer: [DisallowRun] 1
Task: {2C34FB00-22E4-4001-897A-137EB680DB87} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe (Нет файла)
FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension => не найдено
HKLM\SYSTEM\CurrentControlSet\Services\458B7D610BD12214 <==== ВНИМАНИЕ (Rootkit!)
2025-09-24 12:26 - 2024-12-18 17:58 - 000000000 ___HD C:\Program Files\RDP Wrapper
2025-09-24 11:55 - 2024-12-18 17:56 - 000000000 __SHD C:\ProgramData\WindowsTask
2025-09-24 11:53 - 2024-12-18 17:56 - 000000000 __SHD C:\ProgramData\Windows Tasks Service
2025-09-24 11:53 - 2024-12-18 17:56 - 000000000 __SHD C:\ProgramData\ReaItekHD
2024-12-18 17:57 C:\Program Files\AVAST Software
2024-12-18 17:57 C:\Program Files\AVG
2024-12-18 17:57 C:\Program Files\Bitdefender Agent
2024-12-18 17:57 C:\Program Files\ByteFence
2024-12-18 17:57 C:\Program Files\Cezurity
2024-12-18 17:57 C:\Program Files\COMODO
2024-12-18 17:57 C:\Program Files\DrWeb
2024-12-18 17:57 C:\Program Files\Enigma Software Group
2024-12-18 17:57 C:\Program Files\EnigmaSoft
2024-12-18 17:57 C:\Program Files\ESET
2024-12-18 17:57 C:\Program Files\HitmanPro
2024-12-18 17:57 C:\Program Files\Kaspersky Lab
2024-12-18 17:57 C:\Program Files\Loaris Trojan Remover
2024-12-18 17:57 C:\Program Files\Malwarebytes
2024-12-18 17:57 C:\Program Files\NETGATE
2024-12-18 17:57 C:\Program Files\Process Hacker 2
2024-12-18 17:57 C:\Program Files\Process Lasso
2024-12-18 17:57 C:\Program Files\QuickCPU
2024-12-18 17:57 C:\Program Files\Rainmeter
2024-12-18 17:57 C:\Program Files\Ravantivirus
2024-12-18 17:57 C:\Program Files\RogueKiller
2024-12-18 17:57 C:\Program Files\SpyHunter
2024-12-18 17:57 C:\Program Files\SUPERAntiSpyware
2024-12-18 17:57 C:\Program Files\Transmission
2024-12-18 17:57 C:\Program Files (x86)\360
2024-12-18 17:57 C:\Program Files (x86)\AVAST Software
2024-12-18 17:57 C:\Program Files (x86)\AVG
2024-12-18 17:57 C:\Program Files (x86)\Cezurity
2024-12-18 17:57 C:\Program Files (x86)\GPU Temp
2024-12-18 17:57 C:\Program Files (x86)\GRIZZLY Antivirus
2024-12-18 17:57 C:\Program Files (x86)\Kaspersky Lab
2024-12-18 17:57 C:\Program Files (x86)\Microsoft JDX
2024-12-18 17:57 C:\Program Files (x86)\Moo0
2024-12-18 17:57 C:\Program Files (x86)\Panda Security
2024-12-18 17:57 C:\Program Files (x86)\SpeedFan
2024-12-18 17:57 C:\Program Files (x86)\SpyHunter
2024-12-18 17:57 C:\Program Files (x86)\Transmission
2024-12-18 17:57 C:\Program Files\Common Files\AV
2024-12-18 17:57 C:\Program Files\Common Files\Doctor Web
2024-12-18 17:57 C:\Program Files\Common Files\McAfee
2024-12-18 17:57 C:\ProgramData\360safe
2024-12-18 17:57 C:\ProgramData\AVAST Software
2024-12-18 17:57 C:\ProgramData\Avira
2024-12-18 17:57 C:\ProgramData\BookManager
2024-12-18 17:57 C:\ProgramData\Doctor Web
2024-12-18 17:57 C:\ProgramData\ESET
2024-12-18 17:57 C:\ProgramData\Evernote
2024-12-18 17:57 C:\ProgramData\FingerPrint
2024-12-18 17:57 C:\ProgramData\grizzly
2024-12-18 17:57 C:\ProgramData\Kaspersky Lab
2024-12-18 17:57 C:\ProgramData\Kaspersky Lab Setup Files
2024-12-18 17:57 C:\ProgramData\McAfee
2024-12-18 17:57 C:\ProgramData\Norton
2024-12-18 17:57 C:\ProgramData\princeton-produce
2024-12-18 17:57 C:\ProgramData\PuzzleMedia
2024-12-18 17:57 C:\ProgramData\RobotDemo
2024-12-18 17:57 C:\ProgramData\WavePad
2024-12-18 17:57 C:\Users\Пользователь\Desktop\AutoLogger
2024-12-18 17:57 C:\Users\Пользователь\Desktop\AV_block_remover
2024-12-18 17:57 C:\Users\Пользователь\Downloads\AutoLogger
2024-12-18 17:57 C:\Users\Пользователь\Downloads\AV_block_remover
2024-12-18 17:57 C:\Users\Пользователь\AppData\Roaming\Sysfiles
StartPowershell:
Remove-MpPreference -ExclusionPath "C:\ProgramData\WindowsTask\AppModule.exe"
Remove-MpPreference -ExclusionPath "C:\ProgramData\ReaItekHD\taskhost.exe"
Remove-MpPreference -ExclusionPath "C:\ProgramData\WindowsTask\audiodg.exe"
Remove-MpPreference -ExclusionPath "C:\Program Files\RDP Wrapper"
Remove-MpPreference -ExclusionPath "C:\Windows\SysWow64\unsecapp.exe"
Remove-MpPreference -ExclusionPath "C:\ProgramData\WindowsTask\AMD.exe"
Remove-MpPreference -ExclusionPath "C:\ProgramData"
Remove-MpPreference -ExclusionPath "C:\ProgramData\WindowsTask\AppHost.exe"
Remove-MpPreference -ExclusionPath "C:\ProgramData\ReaItekHD\taskhostw.exe"
Set-MpPreference -DisableAutoExclusions $true -Force
Set-MpPreference -Mapsreporting basic -Force
Set-MpPreference -DisableArchiveScanning $false -Force
Set-MpPreference -DisableBehaviorMonitoring $false -Force
Set-MpPreference -DisableRealtimeMonitoring $false -Force
Set-MpPreference -DisablePrivacyMode $true -Force
Set-MpPreference -DisableIOAVProtection $false -Force
Set-MpPreference -UILockdown 0
Set-MpPreference -ScanPurgeItemsAfterDelay 1
Set-MpPreference -CheckForSignaturesBeforeRunningScan $true -Force
Set-MpPreference -PUAProtection enabled -Force
Update-MpSignature
Get-MpComputerStatus
Get-MpPreference
Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage
Get-AppxPackage Microsoft.SecHealthUI -AllUsers|select Name, Status
EndPowerShell:
Reg: reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules C:\Firewall.reg
C:\Firewall.reg
CMD: netsh advfirewall reset
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
StartRegedit:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS]
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00
"Description"="@%systemroot%\\system32\\vssvc.exe,-101"
"DisplayName"="@%systemroot%\\system32\\vssvc.exe,-102"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,76,\
00,73,00,73,00,76,00,63,00,2e,00,65,00,78,00,65,00,00,00
"ObjectName"="LocalSystem"
"ServiceSidType"=dword:00000001
"Start"=dword:00000003
"Type"=dword:00000010
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\SPP]
"SppGetSnapshots (Enter)"=hex:48,00,00,00,00,00,00,00,7b,cb,cc,74,64,8b,d9,01,\
a8,07,00,00,fc,1d,00,00,d2,07,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00
"SppGetSnapshots (Leave)"=hex:48,00,00,00,00,00,00,00,9b,f2,d3,74,64,8b,d9,01,\
a8,07,00,00,fc,1d,00,00,d2,07,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00
"SppEnumGroups (Enter)"=hex:48,00,00,00,00,00,00,00,9b,f2,d3,74,64,8b,d9,01,a8,\
07,00,00,fc,1d,00,00,d1,07,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00
"SppEnumGroups (Leave)"=hex:48,00,00,00,00,00,00,00,9b,f2,d3,74,64,8b,d9,01,a8,\
07,00,00,fc,1d,00,00,d1,07,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\ASR Writer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\BITS Writer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\COM+ REGDB Writer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\MSSearch Service Writer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\Registry Writer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\Shadow Copy Optimization Writer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\System Writer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\VolSnap]
"VolumesSafeForWrite (Enter)"=hex:48,00,00,00,00,00,00,00,07,0a,40,71,64,8b,d9,\
01,00,00,00,00,00,00,00,00,1e,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00
"VolumesSafeForWrite (Leave)"=hex:48,00,00,00,00,00,00,00,07,0a,40,71,64,8b,d9,\
01,00,00,00,00,00,00,00,00,1f,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\VssapiPublisher]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\WMI Writer]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Providers]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Providers\{b5946137-7b9f-4925-af80-51abd60b20d5}]
@="Microsoft Software Shadow Copy provider 1.0"
"Type"=dword:00000001
"Version"="1.0.0.7"
"VersionId"="{00000001-0000-0000-0007-000000000001}"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Providers\{b5946137-7b9f-4925-af80-51abd60b20d5}\CLSID]
@="{65EE1DBA-8FF4-4a58-AC1C-3470EE2F376A}"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Settings]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Settings\WritersBlockingRevert]
"TornComponentsBlockRevert"=dword:00000001
"{2707761B-2324-473D-88EB-EB007A359533}"="DFS-R Writer"
"{B2014C9E-8711-4C5C-A5A9-3CF384484757}"="AD Writer"
"{D76F5A28-3092-4589-BA48-2958FB88CE29}"="FRS Writer"
"{DD846AAA-A1B6-42a8-AAF8-03DCB6114BFD}"="ADAM Writer"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\VssAccessControl]
"NT Authority\NetworkService"=dword:00000001
EndRegedit:
StartRegedit:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TermService]
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00
"Description"="@%SystemRoot%\\System32\\termsrv.dll,-267"
"DisplayName"="@%SystemRoot%\\System32\\termsrv.dll,-268"
"ErrorControl"=dword:00000001
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00,00,00,00,00,60,ea,00,00
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,53,00,65,00,72,00,76,\
00,69,00,63,00,65,00,00,00
"ObjectName"="NT Authority\\NetworkService"
"RequiredPrivileges"=hex(7):53,00,65,00,41,00,73,00,73,00,69,00,67,00,6e,00,50,\
00,72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,\
72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,41,00,75,\
00,64,00,69,00,74,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\
00,00,53,00,65,00,43,00,68,00,61,00,6e,00,67,00,65,00,4e,00,6f,00,74,00,69,\
00,66,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,\
53,00,65,00,43,00,72,00,65,00,61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61,\
00,6c,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,\
65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,00,61,00,74,00,65,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,\
6e,00,63,00,72,00,65,00,61,00,73,00,65,00,51,00,75,00,6f,00,74,00,61,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
"ServiceSidType"=dword:00000001
"Start"=dword:00000003
"Type"=dword:00000020
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TermService\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
74,00,65,00,72,00,6d,00,73,00,72,00,76,00,2e,00,64,00,6c,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TermService\Performance]
"Close"="CloseTSObject"
"Collect"="CollectTSObjectData"
"Collect Timeout"=dword:000003e8
"Library"="C:\\Windows\\System32\\perfts.dll"
"Open"="OpenTSObject"
"Open Timeout"=dword:000003e8
"InstallType"=dword:00000001
"PerfIniFile"="tslabels.ini"
"First Counter"=dword:00001a76
"Last Counter"=dword:00001a76
"First Help"=dword:00001a77
"Last Help"=dword:00001a77
"Object List"="6774"
EndRegedit:
StartRegedit:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\swprv]
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00
"Description"="@%SystemRoot%\\System32\\swprv.dll,-102"
"DisplayName"="@%SystemRoot%\\System32\\swprv.dll,-103"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,73,00,77,00,70,00,72,00,76,00,00,00
"ObjectName"="LocalSystem"
"RequiredPrivileges"=hex(7):53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,\
68,00,61,00,6e,00,67,00,65,00,4e,00,6f,00,74,00,69,00,66,00,79,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,\
65,00,61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,\
00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,00,\
61,00,74,00,65,00,50,00,65,00,72,00,6d,00,61,00,6e,00,65,00,6e,00,74,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,\
6d,00,70,00,65,00,72,00,73,00,6f,00,6e,00,61,00,74,00,65,00,50,00,72,00,69,\
00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,4d,00,61,00,6e,00,\
61,00,67,00,65,00,56,00,6f,00,6c,00,75,00,6d,00,65,00,50,00,72,00,69,00,76,\
00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,74,00,\
6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\
00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00,73,00,65,00,42,00,61,00,\
73,00,65,00,50,00,72,00,69,00,6f,00,72,00,69,00,74,00,79,00,50,00,72,00,69,\
00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,4d,00,61,00,6e,00,\
61,00,67,00,65,00,56,00,6f,00,6c,00,75,00,6d,00,65,00,50,00,72,00,69,00,76,\
00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,74,00,\
6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\
00,53,00,65,00,54,00,63,00,62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,\
67,00,65,00,00,00,00,00
"ServiceSidType"=dword:00000001
"Start"=dword:00000003
"Type"=dword:00000010
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\swprv\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
73,00,77,00,70,00,72,00,76,00,2e,00,64,00,6c,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
EndRegedit:
EmptyEventLogs:
EmptyTemp:
Reboot:
End::