Примите к сведению - после выполнения скрипта (возможно) все открытые вкладки браузеров будут закрыты, произойдет выход из аккаунтов, временные файлы, корзина, история браузеров, куки и кэш будут очищены.
- Отключите до перезагрузки антивирус.
- Выделите следующий код:
Код:
Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
HKLM\...\Policies\Explorer: [SettingsPageVisibility] hide:windowsdefender
HKLM\...\Policies\Explorer: [NoWindowsUpdate] 1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ограничение <==== ВНИМАНИЕ
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Ограничение <==== ВНИМАНИЕ
HKLM\SOFTWARE\Policies\Microsoft\MRT: Ограничение <==== ВНИМАНИЕ
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center: Ограничение <==== ВНИМАНИЕ
HKLM\Software\Policies\...\system: [EnableSmartScreen] 0
GroupPolicy: Ограничение ? <==== ВНИМАНИЕ
Policies: C:\ProgramData\NTUSER.pol: Ограничение <==== ВНИМАНИЕ
C:\Users\Zhanna\AppData\Local\Google\Chrome\User Data\Default\Extensions\aegnopegbbhjeeiganiajffnalhlkkjb
C:\Users\Zhanna\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aegnopegbbhjeeiganiajffnalhlkkjb
CHR StartupUrls: Profile 3 -> "hxxp://www.google.com/","hxxp://avg.nation.com/avgtbavg/search/home?cid={D72E18C1-F5B6-4723-8ED2-CB0FCAA44D37}&mid=5285613928d147d3a8426d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&pr=fr&d=2013-09-28 10:33:29&v=17.0.1.7&pid=nation&sg=&sap=hp","hxxp://avg.nation.com/avgtbavg/search/home?cid={D72E18C1-F5B6-4723-8ED2-CB0FCAA44D37}&mid=5285613928d147d3a8426d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&pr=fr&d=2013-09-28 10:33:29&v=17.0.1.7&pid=nation&sg=&sap=hp&cmpid=0913b","hxxp://www.google.com/|hxxp://avg.nation.com/avgtbavg/search/home?cid={D72E18C1-F5B6-4723-8ED2-CB0FCAA44D37}&mid=5285613928d147d3a8426d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&pr=fr&d=2013-09-28 10:33:29&v=17.0.1.9&pid=nation&sg=0&sap=hp|hxxp://avg.nation.com/avgtbavg/search/home?cid={D72E18C1-F5B6-4723-8ED2-CB0FCAA44D37}&mid=5285613928d147d3a8426d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&pr=fr&d=2013-09-28 10:33:29&v=17.0.1.7&pid=nation&sg=&sap=hp&cmpid=0913b","hxxp://mysearch.avg.com?cid={6ED75B83-4ED3-47DB-8F16-FA0C09D94167}&mid=d1b3d61e4cb847d3882f6d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2013-12-23 10:01:30&v=17.2.0.38&pid=safeguard&sg=&sap=hp","hxxp://mysearch.avg.com?cid={7C0A9D0C-C743-4DFB-A865-37E1F34FD9C3}&mid=912a4991a04647d28bec6d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2013-12-27 18:47:24&v=17.2.0.38&pid=safeguard&sg=&sap=hp","hxxp://mysearch.avg.com?cid={7C0A9D0C-C743-4DFB-A865-37E1F34FD9C3}&mid=912a4991a04647d28bec6d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-05 23:23:36&v=17.3.1.204&pid=safeguard&sg=&sap=hp","hxxp://mysearch.avg.com?cid={FD26F521-443E-4F04-9FD9-27BB08791870}&mid=912a4991a04647d28bec6d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-04-19 17:44:43&v=18.0.5.292&pid=safeguard&sg=&sap=hp","hxxp://www.google.com/|hxxp://avg.nation.com/avgtbavg/search/home?cid={FD26F521-443E-4F04-9FD9-27BB08791870}&mid=912a4991a04647d28bec6d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&pr=fr&d=2013-09-28 10:33:29&v=18.0.5.292&pid=nation&sg=&sap=hp|hxxp://avg.nation.com/avgtbavg/search/home?cid={D72E18C1-F5B6-4723-8ED2-CB0FCAA44D37}&mid=5285613928d147d3a8426d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&pr=fr&d=2013-09-28 10:33:29&v=17.0.1.7&pid=nation&sg=&sap=hp&cmpid=0913b|hxxp://www.google.com/|hxxp://avg.nation.com/avgtbavg/search/home?cid={D72E18C1-F5B6-4723-8ED2-CB0FCAA44D37}&mid=5285613928d147d3a8426d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&pr=fr&d=2013-09-28 10:33:29&v=17.0.1.9&pid=nation&sg=0&sap=hp|hxxp://avg.nation.com/avgtbavg/search/home?cid={D72E18C1-F5B6-4723-8ED2-CB0FCAA44D37}&mid=5285613928d147d3a8426d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&pr=fr&d=2013-09-28 10:33:29&v=17.0.1.7&pid=nation&sg=&sap=hp&cmpid=0913b|hxxp://mysearch.avg.com?cid={6ED75B83-4ED3-47DB-8F16-FA0C09D94167}&mid=d1b3d61e4cb847d3882f6d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2013-12-23 10:01:30&v=17.2.0.38&pid=safeguard&sg=&sap=hp|hxxp://mysearch.avg.com?cid={7C0A9D0C-C743-4DFB-A865-37E1F34FD9C3}&mid=912a4991a04647d28bec6d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2013-12-27 18:47:24&v=17.2.0.38&pid=safeguard&sg=&sap=hp|hxxp://mysearch.avg.com?cid={7C0A9D0C-C743-4DFB-A865-37E1F34FD9C3}&mid=912a4991a04647d28bec6d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-05 23:23:36&v=17.3.1.204&pid=safeguard&sg=&sap=hp|hxxp://mysearch.avg.com?cid={FD26F521-443E-4F04-9FD9-27BB08791870}&mid=912a4991a04647d28bec6d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-04-19 17:44:43&v=18.0.5.292&pid=safeguard&sg=&sap=hp","hxxp://mysearch.avg.com?cid={FD26F521-443E-4F04-9FD9-27BB08791870}&mid=912a4991a04647d28bec6d16b2ade615-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=ru&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-04-19 17:44:43&v=18.1.0.443&pid=safeguard&sg=&sap=hp"
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]
S3 AAErrorPort; C:\Users\Zhanna\AppData\Local\Temp\ActiveAnticheat\1223440\aaerrport.exe [X] <==== ВНИМАНИЕ
AlternateDataStreams: C:\WINDOWS\Temp:A96ECA9E [48]
AlternateDataStreams: C:\WINDOWS\Temp:DeviceUUID [64]
AlternateDataStreams: C:\WINDOWS\tracing:? [16]
AlternateDataStreams: C:\ProgramData\rtpeskt:1F3D48CBE8 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis True Image.lnk:A797F41ABF [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop 2021.lnk:6E6E4AA64E [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini:41964AA945 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk:F9B57EE960 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive для бизнеса.lnk:1438E2ED3D [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk:86E8B79B48 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk:E033AD74A8 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher 2016.lnk:17B869069B [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer.lnk:C7FE7E9A98 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Updates Enabler.lnk:97CDD9288C [3442]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [10534]
AlternateDataStreams: C:\Users\Zhanna\AppData\Local\Microsoft:ISBD [32]
FirewallRules: [{B7AAF195-3EAE-4A89-BEAB-83C87ED6A06F}] => (Allow) LPort=27015
FirewallRules: [{740A0A33-7314-4C3B-A5B6-AC31B28D9EA2}] => (Allow) LPort=80
FirewallRules: [{02A53902-461B-4B38-B5D9-8951DBAB387E}] => (Allow) D:\Programs\3utools\3uTools\libXunlei\Download\MiniThunderPlatform.exe => Нет файла
FirewallRules: [{B7CE42CB-4508-4522-8945-11DF41CC0AA2}] => (Allow) D:\Programs\3utools\3uTools\libXunlei\Download\MiniThunderPlatform.exe => Нет файла
FirewallRules: [{5E1B8923-F2AD-413C-BF66-550FF4D356C0}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe => Нет файла
FirewallRules: [{9044CC27-9365-445F-9BD2-A53C2D7A4D5F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe => Нет файла
FirewallRules: [{40614704-53DB-452F-96FA-52F0E4E66221}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe => Нет файла
FirewallRules: [{0B1733BD-D88A-4F9D-BB4F-A7BA229246CC}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe => Нет файла
FirewallRules: [{6A6C09A5-DBD3-44C2-9FDD-3367AD807C15}] => (Allow) LPort=1688
FirewallRules: [{CE6C744F-06D1-4911-8351-F195C54C748A}] => (Allow) LPort=32682
StartPowershell:
Set-MpPreference -DisableAutoExclusions $true -Force
Set-MpPreference -Mapsreporting basic -Force
Set-MpPreference -DisableRealtimeMonitoring $false -Force
Set-MpPreference -DisablePrivacyMode $true -Force
Set-MpPreference -DisableIOAVProtection $false -Force
Set-MpPreference -UILockdown 0
Set-MpPreference -ScanPurgeItemsAfterDelay 1
Set-MpPreference -CheckForSignaturesBeforeRunningScan $true -Force
Set-MpPreference -PUAProtection enabled -Force
Update-MpSignature
Get-MpComputerStatus
Get-MpPreference
EndPowershell:
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyTemp:
Reboot:
End::
- Скопируйте выделенный текст (правой кнопкой - Копировать).
- Запустите FRST (FRST64) от имени администратора.
- Нажмите Исправить (Fix) один раз (!) и подождите. Программа создаст лог-файл (Fixlog.txt). Прикрепите его к своему следующему сообщению.
Компьютер будет перезагружен автоматически.
Подробнее читайте в
этом руководстве.
