begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
ClearQuarantineEx(true);
TerminateProcessByName('c:\users\asus\appdata\local\soax-m\soax-m.exe');
QuarantineFile('C:\Users\Asus\appdata\local\browserupdphenix\browserupdphenix.exe', '');
QuarantineFile('c:\users\asus\appdata\local\soax-m\soax-m.exe', '');
QuarantineFile('C:\Users\Asus\appdata\roaming\microsoft\windows\helper.exe', '');
DeleteFile('C:\Users\Asus\appdata\local\browserupdphenix\browserupdphenix.exe', '32');
DeleteFile('c:\users\asus\appdata\local\soax-m\soax-m.exe', '32');
DeleteFile('C:\Users\Asus\appdata\roaming\microsoft\windows\helper.exe', '');
ExecuteSysClean;
ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.begin
DeleteFile(GetAVZDirectory+'quarantine.7z');
ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pmalware quarantine .\Quarantine\*', 1, 300000, false);
end.Настоятельно советую удалить. У неё крайне плохая репутация.
Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ограничение <==== ВНИМАНИЕ
HKU\S-1-5-21-1164040657-628915492-640966225-1000\...\MountPoints2: {7df9d266-2127-11e8-844f-10bf481bc4cb} - F:\autorun.exe
HKU\S-1-5-21-1164040657-628915492-640966225-1000\...\MountPoints2: {7df9d270-2127-11e8-844f-10bf481bc4cb} - G:\Autorun.exe
GroupPolicy\User: Ограничение ? <==== ВНИМАНИЕ
Policies: C:\Users\Asus\NTUSER.pol: Ограничение <==== ВНИМАНИЕ
C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Profile 6\Extensions\hbkdeaccegiikknckeoppkblopjnljhf
C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Profile 6\Extensions\mjmpfdkmpojoeemjmfiddlhkkndcdpno
C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Profile 7\Extensions\hbkdeaccegiikknckeoppkblopjnljhf
C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Profile 7\Extensions\mjmpfdkmpojoeemjmfiddlhkkndcdpno
C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Profile 8\Extensions\hbkdeaccegiikknckeoppkblopjnljhf
C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Profile 8\Extensions\mjmpfdkmpojoeemjmfiddlhkkndcdpno
CHR HKU\S-1-5-21-1164040657-628915492-640966225-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjmpfdkmpojoeemjmfiddlhkkndcdpno]
CHR HKLM-x32\...\Chrome\Extension: [lgdnilodcpljomelbbnpgdogdbmclbni]
C:\Users\Asus\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extensions\hbkdeaccegiikknckeoppkblopjnljhf
U3 aswbdisk; отсутствует ImagePath
Unlock: C:\Users\Asus\AppData\Roaming\AdvertismentImages
Unlock: C:\Program Files\spyhunter
Unlock: C:\Program Files\Enigma Software Group
Unlock: C:\Program Files\ByteFence
2022-07-24 22:20 - 2022-07-24 22:20 - 000000001 _RHOT C:\Users\Asus\AppData\Roaming\AdvertismentImages
2022-07-24 22:20 - 2022-07-24 22:20 - 000000001 _RHOT C:\Program Files\spyhunter
2022-07-24 22:20 - 2022-07-24 22:20 - 000000001 _RHOT C:\Program Files\Enigma Software Group
2022-07-24 22:20 - 2022-07-24 22:20 - 000000001 _RHOT C:\Program Files\ByteFence
2022-07-24 22:19 - 2022-07-25 13:37 - 000000000 ____D C:\ProgramData\Чистилка
Ghostery - Privacy Ad Blocker 1.0.0.0 (HKU\S-1-5-21-1164040657-628915492-640966225-1000\...\{26437a06-325b-408c-a1d0-9e4c65287de8}) (Version: 1.0.0.0 - Ghostery) Hidden
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Нет файла
WMI:subscription\__FilterToConsumerBinding->CommandLineEventConsumer.Name=\"BVTConsumer\"",Filter="__EventFilter.Name=\"BVTFilter\"::
WMI:subscription\__EventFilter->BVTFilter::[Query => SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99]
WMI:subscription\CommandLineEventConsumer->BVTConsumer::[CommandLineTemplate => cscript KernCap.vbs][WorkingDirectory => C:\\tools\\kernrate]
HKU\S-1-5-21-1164040657-628915492-640966225-1000\Software\Classes\.exe: => <==== ВНИМАНИЕ
FirewallRules: [{51EDE036-5F4D-4239-A8D1-8D405FEE1C14}] => (Allow) C:\Users\Asus\AppData\Local\MediaGet2\mediaget.exe => Нет файла
FirewallRules: [{E0089684-FB72-4A68-A3B9-56E2071ADBDC}] => (Allow) C:\Users\Asus\AppData\Local\MediaGet2\mediaget.exe => Нет файла
FirewallRules: [{38C11135-853F-4F04-A0C3-468323BE5BE2}] => (Allow) C:\Program Files\Easeware\DriverEasy\DriverEasy.exe => Нет файла
FirewallRules: [{FEECDFBA-77D2-4DC7-B112-0F72F7EFF0B5}] => (Allow) C:\Users\Asus\MediaGet2\mediaget.exe => Нет файла
FirewallRules: [{4BAE48EB-816B-45EC-ADD1-763D9A72760D}] => (Allow) C:\Users\Asus\MediaGet2\mediaget.exe => Нет файла
FirewallRules: [{782CC1F7-019D-4E10-807D-19EC56B2FC49}] => (Allow) C:\Users\Asus\MediaGet2\QtWebEngineProcess.exe => Нет файла
FirewallRules: [{CBDF9F0F-CCEB-4CF1-A458-942F0707B7CF}] => (Allow) C:\Users\Asus\MediaGet2\QtWebEngineProcess.exe => Нет файла
FirewallRules: [{AC2D6F1E-26C4-4E27-805C-1F4B7DCCD03E}] => (Allow) C:\Users\Asus\AppData\Local\soax-m\soax-m.exe => Нет файла
FirewallRules: [{A5261B5C-3B06-4E8E-900B-90049F0E5A2D}] => (Allow) C:\Users\Asus\AppData\Local\soax-m\soax-m.exe => Нет файла
FirewallRules: [{F32FFA9F-C172-42FE-A3F2-BF0F68073475}] => (Allow) LPort=7777
FirewallRules: [{81B4B7EB-2637-4D85-8DC4-E5423ADAC9B6}] => (Allow) LPort=7777
FirewallRules: [{12D3A24E-24DE-4EE0-B4D3-1DDC07A98F29}] => (Allow) LPort=7777
FirewallRules: [{1B114826-F21F-4BE1-A349-849500612536}] => (Allow) LPort=7777
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyTemp:
Reboot:
End::
Удалите.
