begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
QuarantineFile('C:\Users\zxcde\AppData\Local\Programs\699a03abd1\ffbd55e5ff.msi','');
QuarantineFile('C:\WINDOWS\SysWOW64\mobsync.dll','');
DeleteFile('C:\Users\zxcde\AppData\Local\Programs\699a03abd1\ffbd55e5ff.msi','64');
DeleteFile('C:\WINDOWS\SysWOW64\mobsync.dll','64');
DeleteSchedulerTask('vein-personality');
DeleteSchedulerTask('post-and-S-1-5-21-1708268482-3721676537-971620817-1001');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\MobSyncBrokerSvc_2197eb\Parameters','ServiceDll','x64');
BC_Activate;
ExecuteSysClean;
ExecuteWizard('SCU', 2, 3, true);
BC_ImportALL;
RebootWindows(true);
end.begin
DeleteFile(GetAVZDirectory+'quarantine.7z');
ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pmalware quarantine .\Quarantine\*', 1, 300000, false);
end.
Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
GroupPolicy: Ограничение - Windows Defender <==== ВНИМАНИЕ
Policies: C:\ProgramData\NTUSER.pol: Ограничение <==== ВНИМАНИЕ
CHR HKU\S-1-5-21-1708268482-3721676537-971620817-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bafodoggphpfleoconpidjbljeaahjkj]
2024-08-04 02:16 C:\ProgramData\RDP Wrapper
Post and Search 1.0.0.0 (HKU\S-1-5-21-1708268482-3721676537-971620817-1001\...\{8afae2f3-9f6a-4fd6-9582-49e11270fe70}) (Version: 1.0.0.0 - Post and Search) Hidden
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [6146]
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyTemp:
Reboot:
End::Удалите.
