O4 - HKCU\..\StartupApproved\Run: [Firefox Browser] = ;C:\Firefox\X-Firefox.exe (file missing) (2023/12/27)
O7 - Policy: HKLM\Software\Microsoft\Windows Defender\Features: [TamperProtection] = 4
O18 - HKLM\Software\Classes\Protocols\Filter\application/octet-stream: [CLSID] = {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - (no file)
O18 - HKLM\Software\Classes\Protocols\Filter\application/x-complus: [CLSID] = {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - (no file)
O18 - HKLM\Software\Classes\Protocols\Filter\application/x-msdownload: [CLSID] = {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - (no file)
O22 - Tasks: \Microsoft\Windows\MasterDataY\RecoveryHosts - C:\ProgramData\Microsoft\MapData\L4LtolJ1cntz1a\MasterDataY.bat (file missing)
O23 - Driver S3: cpuz149 - C:\Users\Home\AppData\Local\Temp\cpuz149\cpuz149_x64.sys (file missing)
O26 - Office Addin: HKLM\..\NativeShim - (Inquire) -> (no file)
O27 - Account: (Hidden) User 'John' is invisible on logon screen
O27 - RDP: (Other) HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server: [fDenyTSConnections] = 0
Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
Unlock: C:\FRST\
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ограничение <==== ВНИМАНИЕ
Task: {ED83655B-F2F7-4B2D-8472-E2AB8EA3F4F6} - System32\Tasks\Opera scheduled Autoupdate 1703693962 => C:\Users\Home\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (Нет файла)
CHR HKU\S-1-5-21-875882286-2091808483-2287046148-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dkekdlkmdpipihonapoleopfekmapadh]
2025-02-07 14:19 - 2025-02-07 14:19 - 000037376 _____ (Microsoft Corporation) C:\Windows\system32\rfxvmt.dll
AlternateDataStreams: C:\ProgramData\360Safe.Summary.union1:514561AD28 [3442]
AlternateDataStreams: C:\ProgramData\360Safe.Summary.union1:BEA5C52C1F [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AmneziaWG.lnk:9D5798B91D [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini:41964AA945 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote.lnk:60EC9648C0 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook (classic).lnk:5465085A2F [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook (classic).lnk:BE800952D3 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk:1DC1525F34 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk:104946E0EA [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype для бизнеса.lnk:DCFC4C61B7 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sticky Notes (new).lnk:3DF0A9C0EF [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sticky Notes (new).lnk:954E53D7F9 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer.lnk:C7FE7E9A98 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VK Мессенджер.lnk:0351EE95D1 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk:7AD7FA8AB1 [3442]
CMD: netsh advfirewall reset
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyTemp:
Reboot:
End::Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
Unlock: C:\FRST\
StartPowershell:
Remove-MpPreference -ExclusionPath "C:\ProgramData"
Remove-MpPreference -ExclusionPath "C:\Program Files\RDP Wrapper"
Remove-MpPreference -ExclusionPath "C:\ProgramData\WindowsTask\AppHost.exe"
Remove-MpPreference -ExclusionPath "C:\ProgramData\WindowsTask\AMD.exe"
Remove-MpPreference -ExclusionPath "C:\ProgramData\WindowsTask\audiodg.exe"
Remove-MpPreference -ExclusionPath "C:\ProgramData\ReaItekHD\taskhost.exe"
Remove-MpPreference -ExclusionPath "C:\ProgramData\WindowsTask\AppModule.exe"
EndPowerShell:
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyTemp:
Reboot:
End::при открытии диспетчера всё также в первую секунду показывает системные прерывания и загруженность 90% цп и выше, потом падает сразу же, так и должно быть?
Да так у всех.