Скачал авз закинул на пк - итог оно закрывается моментально пытался переменовать не помогает
надо еще что-то сделать или вирус удален?
Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
HKLM\...\Run: [SoftEther VPN Client UI Helper] => "D:\Games\SoftEther VPN Client\vpnclient_x64.exe" /uihelp (Нет файла)
HKLM-x32\...\Run: [RadminVPN] => "C:\Program Files (x86)\Radmin VPN\RvRvpnGui.exe" /minimized (Нет файла)
HKLM-x32\...\Run: [X-VPN] => "D:\Games\X-VPN\X-VPN.exe" (Нет файла)
HKLM\SOFTWARE\Policies\Microsoft\MRT: Ограничение <==== ВНИМАНИЕ
HKLM\SYSTEM\...\Terminal Server: [fDenyTSConnections] = 0 <==== ВНИМАНИЕ
HKU\S-1-5-21-565269223-4282563807-3192084766-1001\...\MountPoints2: {20b2ec25-3664-11ef-aa5c-caf9ad3aec01} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-565269223-4282563807-3192084766-1001\...\MountPoints2: {339639fb-c2f6-11ef-aca4-caf9ad3aec01} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-565269223-4282563807-3192084766-1001\...\MountPoints2: {f43b5684-e939-11ee-a90a-a85e452b1a75} - "E:\HiSuiteDownLoader.exe"
IFEO\autoruns.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\autorunsc.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\bcdedit.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\dism.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\GlassWire.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\GlassWireSetup.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\MediaCreationTool22H2.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\mmc.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\mstsc.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\PowerTool.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\PowerTool64.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\ReAgentc.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\recoverydrive.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\rstrui.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\systemreset.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\SystemSettingsAdminFlows.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\tcpview.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\tcpview64.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\vssadmin.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\Wireshark.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\wuapihost.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\wuauclt.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\x32dbg.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\x64dbg.exe: [MinimumStackCommitInBytes] 1099466887
IFEO\xcopy.exe: [MinimumStackCommitInBytes] 1099466887
Task: {30306E77-5DFD-43F5-B269-65A5D52126B3} - \Microsoft\Windows\Wininet\winsers -> Нет файла <==== ВНИМАНИЕ
Task: {63656067-F1CD-4F11-803C-DEAA61A01AF6} - \Microsoft\Windows\WindowsBackup\OnlogonCheck -> Нет файла <==== ВНИМАНИЕ
Task: {95628779-A878-42E3-A33A-1935D9E36240} - \Microsoft\Windows\WindowsBackup\FilesBackUP -> Нет файла <==== ВНИМАНИЕ
Task: {F63D9469-F9CA-43F6-AB36-DBC5C259E9C9} - \Microsoft\Windows\Wininet\winser -> Нет файла <==== ВНИМАНИЕ
Task: {8F31F223-F0B9-414A-9202-11F00757905D} - System32\Tasks\D-9-9-97-1154916726-1157026722-1219099416-8743\{HN5LE66A-PVLY-EU2R-EXCL-1LN99434SSVI} => C:\Users\Gamer\AppData\Roaming\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.22621.3672_none_ab1bf7dc85f90385\XAPOFX1_0.exe [1199107 2024-09-12] (Net Win32 API Helpers DLL) [Файл не подписан]
Task: {086D0442-A147-4E34-A4BD-5FBB330C8C95} - System32\Tasks\XVpn_ScheduledTaskRootPath => D:\Games\X-VPN\X-VPN_root.exe (Нет файла)
Task: {6071CC83-968E-4FB3-BBBF-5564202BF5DC} - System32\Tasks\XVpn_ScheduledTaskStartup => D:\Games\X-VPN\X-VPN_root.exe -startup (Нет файла)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ограничение <==== ВНИМАНИЕ
Edge HKU\S-1-5-21-565269223-4282563807-3192084766-1001\SOFTWARE\Microsoft\Edge\Extensions\...\Edge\Extension: [jcpgbnbdnakoblgfkbgggankeidkfcdl]
Edge HKLM-x32\...\Edge\Extension: [caiblelclndcckfafdaggpephhgfpoip]
Edge HKLM-x32\...\Edge\Extension: [emgfgdclgfeldebanedpihppahgngnle]
Edge HKLM-x32\...\Edge\Extension: [jcpgbnbdnakoblgfkbgggankeidkfcdl]
CHR HKU\S-1-5-21-565269223-4282563807-3192084766-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [llbcnfanfmjhpedaedhbcnpgeepdnnok]
CHR HKLM-x32\...\Chrome\Extension: [caljgklbbfbcjjanaijlacgncafpegll]
CHR HKLM-x32\...\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk]
CHR HKLM-x32\...\Chrome\Extension: [llbcnfanfmjhpedaedhbcnpgeepdnnok]
2025-05-31 12:04 - 2025-05-31 12:04 - 000000000 ___SH C:\ProgramData\tg.txt
2025-05-31 12:04 - 2025-05-31 12:04 - 000000000 ___SH C:\ProgramData\temp.txt
2025-05-31 10:47 - 2025-05-31 10:47 - 000037376 _____ (Microsoft Corporation) C:\Windows\system32\rfxvmt.dll
AlternateDataStreams: C:\ProgramData:NT [40]
AlternateDataStreams: C:\ProgramData:NT2 [764]
AlternateDataStreams: C:\Users\All Users:NT [40]
AlternateDataStreams: C:\Users\All Users:NT2 [764]
AlternateDataStreams: C:\Users\Все пользователи:NT [40]
AlternateDataStreams: C:\Users\Все пользователи:NT2 [764]
AlternateDataStreams: C:\ProgramData\Application Data:NT [40]
AlternateDataStreams: C:\ProgramData\Application Data:NT2 [764]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT [40]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2 [764]
AlternateDataStreams: C:\Users\Gamer\Application Data:NT [40]
AlternateDataStreams: C:\Users\Gamer\Application Data:NT2 [764]
AlternateDataStreams: C:\Users\Gamer\AppData\Roaming:NT [40]
AlternateDataStreams: C:\Users\Gamer\AppData\Roaming:NT2 [764]
startbatch:
del /s /q "%userprofile%\AppData\Local\Google\Chrome\User Data\Default\Cache\*.*"
del /s /q "%userprofile%\AppData\Local\Google\Chrome\User Data\Default\Code Cache\Js\*.*"
del /s /q "%userprofile%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\*.*"
del /s /q "%userprofile%\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\Js\*.*"
endbatch:
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyTemp:
Reboot:
End::Постарайтесь освободить хотя бы 20% от его объема.
упакуйте в архив с паролем, залейте на облако, ссылку на скачивание и пароль на архив отправьте мне или коллеге личным сообщением.
Start::
StartPowershell:
Remove-MpPreference -ExclusionPath "C:\ProgramData\WindowsTask\AppModule.exe"
Remove-MpPreference -ExclusionExtension ".exe"
Remove-MpPreference -ExclusionPath "C:\ProgramData\WindowsTask\AMD.exe"
Remove-MpPreference -ExclusionPath "C:\ProgramData\ReaItekHD\taskhost.exe"
Remove-MpPreference -ExclusionPath "C:\ProgramData\WindowsTask\AppHost.exe"
Remove-MpPreference -ExclusionPath "C:\ProgramData"
Remove-MpPreference -ExclusionPath "C:\Program Files\RDP Wrapper"
Remove-MpPreference -ExclusionPath "C:\ProgramData\WindowsTask\audiodg.exe"
Remove-MpPreference -ExclusionPath "C:\Users\Gamer\AppData\Local\Temp"
Remove-MpPreference -ExclusionPath "D:\Games\steam"
Remove-MpPreference -ExclusionPath "C:\Users\Gamer\Desktop"
Remove-MpPreference -ExclusionPath "C:\Users"
Remove-MpPreference -ExclusionPath "C:\Users\Gamer"
Remove-MpPreference -ExclusionPath "C:\Users\Public"
Remove-MpPreference -ExclusionPath "C:\Program Files\Windows Defender\MsMpEng.exe"
EndPowerShell:
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
Reboot:
End::диспетчер устройств открылся службы тоже в общем все ок еще что-то?