Вирус майнинг не дает нормально работать

[Vladisla543]

Похоже поймал вирус майнинг, не дает нормально работать, не могу запустить ни одну программу, выскакивает что запрещено системным администратором, проверил в безопасном режиме Dr.Web Cureit, нашёл какие-то зараженные файлы но проблема не ушла. 

CollectionLog-2024.02.01-13.43.zip

Изменено 1 февраля пользователем Vladisla543

[mike 1]

Здравствуйте, пофиксите в HiJackThis:

 

O7 - AppLocker: (Allow) [AppX] [Publisher] *
O7 - AppLocker: (Allow) [Executable] [Path] %PROGRAMFILES%\*
O7 - AppLocker: (Allow) [Executable] [Path] %PROGRAMFILES%\*
O7 - AppLocker: (Allow) [Executable] [Path] %WINDIR%\*
O7 - AppLocker: (Allow) [Executable] [Path] *
O7 - AppLocker: (Allow) [Executable] [Path] *
O7 - AppLocker: (Allow) [Installer] [Path] %WINDIR%\Installer\*
O7 - AppLocker: (Allow) [Installer] [Path] *.*
O7 - AppLocker: (Allow) [Installer] [Publisher] *
O7 - AppLocker: (Allow) [Script] [Path] %OSDRIVE%\*
O7 - AppLocker: (Allow) [Script] [Path] %PROGRAMFILES%\*
O7 - AppLocker: (Allow) [Script] [Path] %WINDIR%\*
O7 - AppLocker: (Allow) [Script] [Path] *
O7 - AppLocker: (Deny) [Executable] [Hash] 0tIlzz.exe (Size: 9248139) - 0xfc623e48c758afd9d7abd2e180e2672b5af90482d58c18d9ed8b5860d9a5e90e
O7 - AppLocker: (Deny) [Executable] [Hash] 1AVbr.exe (Size: 9057467) - 0x7add7093ab708d7e8a1231cb553c27f8f3780531ed34bb8982c4b252114bc24d
O7 - AppLocker: (Deny) [Executable] [Hash] AutoLogger.exe (Size: 16713268) - 0x62fe663c4b54c627b0249e19ba70b67821559c9bc977b20a2f1145e2add2c3d8
O7 - AppLocker: (Deny) [Executable] [Hash] AVbr.exe (Size: 9254827) - 0x6d05135951d6d4904df42ab73047174e7d42eb5da74cf4742708d6e7a46c94f0
O7 - AppLocker: (Deny) [Executable] [Hash] avz.exe (Size: 794624) - 0xbc7b5245b6976be2578fae4b693e9578118253e564e62b2da04e2d5514eb490f
O7 - AppLocker: (Deny) [Executable] [Hash] ComboFix.exe (Size: 5659583) - 0xcdc83269d90eb7fd908dd5805ab89bb5938c51c2a2cfec4611bbd2acebdcd511
O7 - AppLocker: (Deny) [Executable] [Hash] FRST.exe (Size: 2073600) - 0x57b21ad6b06d866a016ad639b01ecfb447c11664f1156efc85ad2760753ae409
O7 - AppLocker: (Deny) [Executable] [Hash] FSS.exe (Size: 958976) - 0x33c2a1d527d98c1888a2bf3388e667b02975ee3acc16ea392627a61410a4f1fb
O7 - AppLocker: (Deny) [Executable] [Hash] HijackThis.exe (Size: 388608) - 0x399a6288f737f0bb4c765021a7e793b9a7cf013ab47c46fe2919ffff0dcda847
O7 - AppLocker: (Deny) [Executable] [Hash] MBSetup.exe (Size: 2556344) - 0xb7fd9c28b9f193577e895b6032be5211f788dfb255768895e1ef6793b28b5684
O7 - AppLocker: (Deny) [Executable] [Hash] mcafee_trial_setup_433.0207.3919_key.exe (Size: 5891472) - 0xb685e0cf016014a3f940789cc0e3948d5c29be8f67031f282bbda2c9b41e2b98
O7 - AppLocker: (Deny) [Executable] [Hash] RSIT.exe (Size: 1107968) - 0x1b88e94654078ae830c5c111a32a998c93475e07a0ac68f8cb3ba81b44d69419
O7 - AppLocker: (Deny) [Executable] [Publisher] O=ADAWARE SOFTWARE (LAVASOFT SOFTWARE CANADA INC.), L=MONTREAL, S=QUEBEC, C=CA
O7 - AppLocker: (Deny) [Executable] [Publisher] O=ADLICE, S=LOIRE-ATLANTIQUE, C=FR
O7 - AppLocker: (Deny) [Executable] [Publisher] O=AHNLAB, INC., L=SEONGNAM-SI, S=GYEONGGI-DO, C=KR
O7 - AppLocker: (Deny) [Executable] [Publisher] O=ALLIT SERVICE, LLC., L=KYIV, S=KYIVSKA, C=UA
O7 - AppLocker: (Deny) [Executable] [Publisher] O=AO KASPERSKY LAB, L=MOSCOW, C=RU
O7 - AppLocker: (Deny) [Executable] [Publisher] O=AUSLOGICS LABS PTY LTD, L=SYDNEY, S=NEW SOUTH WALES, C=AU
O7 - AppLocker: (Deny) [Executable] [Publisher] O=AVAST SOFTWARE S.R.O., L=PRAHA, C=CZ
O7 - AppLocker: (Deny) [Executable] [Publisher] O=AVG TECHNOLOGIES USA, LLC, L=NEWTON, S=NORTH CAROLINA, C=US
O7 - AppLocker: (Deny) [Executable] [Publisher] O=AVIRA OPERATIONS GMBH, L=TETTNANG, S=BADEN-WÜRTTEMBERG, C=DE
O7 - AppLocker: (Deny) [Executable] [Publisher] O=BEIJING HUORONG NETWORK TECHNOLOGY CO., LTD., L=BEIJING SHI, C=CN
O7 - AppLocker: (Deny) [Executable] [Publisher] O=BEIJING QIHU TECHNOLOGY CO., LTD., S=BEIJING, C=CN
O7 - AppLocker: (Deny) [Executable] [Publisher] O=BITDEFENDER SRL, L=BUCHAREST, C=RO
O7 - AppLocker: (Deny) [Executable] [Publisher] O=BLEEPING COMPUTER, LLC., L=HUNTINGTON STATION, S=NEW YORK, C=US
O7 - AppLocker: (Deny) [Executable] [Publisher] O=BULLGUARD LTD., L=LONDON, S=LONDON, C=GB
O7 - AppLocker: (Deny) [Executable] [Publisher] O=CEZURITY LLC, L=SAINT PETERSBURG, C=RU
O7 - AppLocker: (Deny) [Executable] [Publisher] O=COMODO SECURITY SOLUTIONS, INC., L=CLIFTON, S=NJ, C=US
O7 - AppLocker: (Deny) [Executable] [Publisher] O=EMSISOFT (EMSISOFT LIMITED), S=NELSON, C=NZ
O7 - AppLocker: (Deny) [Executable] [Publisher] O=ENIGMASOFT LIMITED, L=DUBLIN 2, C=IE
O7 - AppLocker: (Deny) [Executable] [Publisher] O=ESET, SPOL. S R.O., L=BRATISLAVA, C=SK
O7 - AppLocker: (Deny) [Executable] [Publisher] O=GLARYSOFT LTD, S=BEIJING, C=CN
O7 - AppLocker: (Deny) [Executable] [Publisher] O=GRIDINSOFT, LLC, L=KYIV, C=UA
O7 - AppLocker: (Deny) [Executable] [Publisher] O=GRIDINSOFT, LLC, L=KYIV, C=UA
O7 - AppLocker: (Deny) [Executable] [Publisher] O=IOBIT CO., LTD, L=CHENGDU, S=SICHUAN, C=CN
O7 - AppLocker: (Deny) [Executable] [Publisher] O=KASPERSKY LAB JSC, L=MOSCOW, C=RU
O7 - AppLocker: (Deny) [Executable] [Publisher] O=KASPERSKY LAB, L=MOSCOW, C=RU
O7 - AppLocker: (Deny) [Executable] [Publisher] O=MALWAREBYTES CORPORATION, L=SANTA CLARA, S=CA, C=US
O7 - AppLocker: (Deny) [Executable] [Publisher] O=MALWAREBYTES INC, L=SANTA CLARA, S=CALIFORNIA, C=US
O7 - AppLocker: (Deny) [Executable] [Publisher] O=MALWAREBYTES INC., S=CALIFORNIA, C=US
O7 - AppLocker: (Deny) [Executable] [Publisher] O=MALWAREBYTES INC., S=CALIFORNIA, C=US
O7 - AppLocker: (Deny) [Executable] [Publisher] O=MCAFEE, LLC, L=SAN JOSE, S=CALIFORNIA, C=US
O7 - AppLocker: (Deny) [Executable] [Publisher] O=MICROWORLD TECHNOLOGIES INC., L=NOVI, S=MICHIGAN, C=US
O7 - AppLocker: (Deny) [Executable] [Publisher] O=NANO SECURITY LLC, L=BRYANSK, S=BRYANSK OBLAST, C=RU
O7 - AppLocker: (Deny) [Executable] [Publisher] O=NORTONLIFELOCK INC., L=TEMPE, S=ARIZONA, C=US
O7 - AppLocker: (Deny) [Executable] [Publisher] O=OOO "GREATIS SOFTVARYA", L=YAROSLAVL, S=YAROSLAVSKAYA OBLAST, C=RU
O7 - AppLocker: (Deny) [Executable] [Publisher] O=PANDA SECURITY S.L., L=BILBAO, S=BASQUE COUNTRY, C=ES
O7 - AppLocker: (Deny) [Executable] [Publisher] O=SIMPLY SUPER SOFTWARE, L=NUNEATON, S=WARWICKSHIRE, C=GB
O7 - AppLocker: (Deny) [Executable] [Publisher] O=SOPHOS LTD, L=ABINGDON, C=GB
O7 - AppLocker: (Deny) [Executable] [Publisher] O=SUPPORT.COM, INC., L=LOS ANGELES, S=CALIFORNIA, C=US
O7 - AppLocker: (Deny) [Executable] [Publisher] O=SURFRIGHT B.V., L=HENGELO, C=NL
O7 - AppLocker: (Deny) [Executable] [Publisher] O=SYMANTEC CORPORATION, L=MOUNTAIN VIEW, S=CALIFORNIA, C=US
O7 - AppLocker: (Deny) [Executable] [Publisher] O=SYSTWEAK SOFTWARE, L=JAIPUR, S=RAJASTHAN, C=IN
O7 - AppLocker: (Deny) [Executable] [Publisher] O=TREND MICRO, INC., S=TAIPEI, C=TW
O7 - AppLocker: (Deny) [Executable] [Publisher] O=WEBROOT, L=BROOMFIELD, S=COLORADO, C=US
O7 - AppLocker: (Deny) [Executable] [Publisher] O=ZEMANA D.O.O. SARAJEVO, L=SARAJEVO, C=BA
O7 - AppLocker: Fix all (including policies)
O7 - Policy: HKCU\..\Windows\Explorer: [DisableNotificationCenter ] = 1
O7 - Policy: HKCU\..\Windows\Explorer: [ShowRunAsDifferentUserInStart] = 1
O22 - Tasks: \Microsoft\Windows\CreedMobeO\qTsKBch38d7lA5VT - C:\Programdata\ReaItekHD\taskhost.exe (file missing)
O22 - Tasks: \Microsoft\Windows\CreedMobeO\RecoveryHosts - C:\ProgramData\Microsoft\MapData\qTsKBch38d7lA5VT\CreedMobeO.bat (not signed - no company - 28984C10655A7A8886C31D0413252E1922CEFDF1)
O22 - Tasks: \Microsoft\Windows\CreedMobeO\RecoveryTask - C:\Programdata\ReaItekHD\taskhostw.exe (file missing)
O22 - Tasks: \Microsoft\Windows\WindowsBackup\BackUpFiles - C:\Programdata\ReaItekHD\taskhost.exe (file missing)
O22 - Tasks: \Microsoft\Windows\WindowsBackup\CashClean - C:\Programdata\ReaItekHD\taskhostw.exe (file missing)
O22 - Tasks: \Microsoft\Windows\WindowsBackup\OnlogonCheck - C:\Programdata\ReaItekHD\taskhostw.exe (file missing)
O22 - Tasks: \Microsoft\Windows\WindowsBackup\WinlogonCheck - C:\Programdata\ReaItekHD\taskhost.exe (file missing)
O22 - Tasks: \Microsoft\Windows\Wininet\winser - C:\ProgramData\Windows Tasks Service\winserv.exe Task Service\winserv.exe (file missing)
O22 - Tasks: \Microsoft\Windows\Wininet\winsers - C:\ProgramData\Windows Tasks Service\winserv.exe Task Service\winserv.exe (file missing)

 

Скачайте AVBR, сохраните в директорию C:\Snikers\ , запустите сканирование, следуйте рекомендациям, прикрепите лог утилиты. 

 

Сделайте новые логи Автологгером в обычном режиме.    

[mike 1]

Сообщение от модератора mike 1

Закрыто в связи с отсутствием обратной связи от пользователя.