[РЕШЕНО] Открытие рекламы при запуске компьютера и запуск непонятных скриптов

[ДмитрийКасперскийКлуб]

При запуске ноутбука открывается бразуер с ссылкой на рекламу, так же после перезапуска бывает сворачивается полноэкранное приложение, будто что-то на фоне начинает выполняться на секунду, что сворачивает активное приложение. После анализа CureIt был обнаружен и вылечен троян trojan starter 7691. Подозреваю, что могло начаться после использования zapret-discord-youtube архива (уже удалил его).

Заранее большое спасибо за помощь!

CollectionLog-2024.12.16-13.39.zip

[thyrex]

Здравствуйте.

 

Запустите AVZ из папки Autologger от имени Администратора по правой кнопке мыши.

 

Выполните скрипт в AVZ (Файл – Выполнить скрипт – вставить текст скрипта из окна Код)

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
QuarantineFile('C:\Program Files\google\chrome\updater.exe','');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','dimax','x32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','dimax','x64');
 DeleteFile('C:\Program Files\google\chrome\updater.exe','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

• Обратите внимание: будет выполнена перезагрузка компьютера.

 

Выполните скрипт в AVZ

begin
DeleteFile(GetAVZDirectory+'quarantine.7z');
ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pmalware quarantine ./Quarantine/', 1, 0, true);
end.

Отправьте quarantine.7z из папки с распакованной утилитой AVZ с помощью формы отправки карантина или на этот почтовый ящик: quarantine <at> safezone.cc (замените <at> на @) с указанием ссылки на тему в теме (заголовке) сообщения и с указанием пароля: malware в теле письма.

 

Пожалуйста, ЕЩЕ РАЗ запустите Autologger; прикрепите к следующему сообщению НОВЫЕ логи.
 

[ДмитрийКасперскийКлуб]

Спасибо! Всё сделано, прикрепляю логи.

 

Имя карантин-а(ов) сообщите в теме:
2024.12.17_quarantine_f63c4fb9babf7d1963275632a313527e.7z

CollectionLog-2024.12.17-14.56.zip

[thyrex]

Скачайте Farbar Recovery Scan Tool (или с зеркала) и сохраните на Рабочем столе.

• Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.

1. Запустите программу двойным щелчком. Когда программа запустится, нажмите Yes для соглашения с предупреждением.
2. Убедитесь, что в окне Optional Scan (Дополнительные опции) отмечены List BCD и 90 Days Files.
3. Нажмите кнопку Scan (Сканировать).
4. После окончания сканирования будет создан отчет (FRST.txt) в той же папке, откуда была запущена программа.
5. Если программа была запущена в первый раз, также будет создан отчет (Addition.txt).
6. Файлы FRST.txt и Addition.txt заархивируйте (в один общий архив) и прикрепите к сообщению.
 

[ДмитрийКасперскийКлуб]

Благодарю за ответ, выполнил.

FRST.7z

[thyrex]

gt-launcher 5.2.2

удалите через Панель управления - Программы и компоненты или принудительно с помощью Geek Uninstaller

 

1. Выделите следующий код и скопируйте в буфер обмена (правая кнопка мыши – Копировать)

Start::
CreateRestorePoint:
HKU\S-1-5-21-3275868829-1350829239-1136396934-1001\...\RunOnce: [Uninstall 24.221.1103.0003] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\dimax\AppData\Local\Microsoft\OneDrive\24.221.1103.0003" [0 2024-12-17] () <==== ATTENTION [zero byte File/Folder]
GroupPolicy: Restriction ? <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {02f0d4cd-0807-445e-b949-2b385dadc42f} - no filepath. <==== ATTENTION
Task: {044fc2ff-c1c3-4358-976c-a6ba23c068a3} - no filepath. <==== ATTENTION
Task: {0a9c219d-f76b-416a-bb74-c5bdd3a992d9} - no filepath. <==== ATTENTION
Task: {0b4ec94c-5310-4eb7-9b1d-f083c22143c3} - no filepath. <==== ATTENTION
Task: {0c240270-8b93-4062-8b9d-586ff59800ac} - no filepath. <==== ATTENTION
Task: {0da12d74-cd3d-46d0-837a-0b9dff97c198} - no filepath. <==== ATTENTION
Task: {0ff7d322-8114-47e4-ae9d-b0e20760e945} - no filepath. <==== ATTENTION
Task: {15baddb1-c32c-433f-a366-9723948456e4} - no filepath. <==== ATTENTION
Task: {191011bd-e21d-471e-bbf3-523bc4ea8509} - no filepath. <==== ATTENTION
Task: {1989f14c-7637-424e-bfcd-486a6e49be67} - no filepath. <==== ATTENTION
Task: {19df9089-6568-4faf-b92b-6e773b258450} - no filepath. <==== ATTENTION
Task: {1a3cac42-08d2-4e12-9817-13a79dbf9718} - no filepath. <==== ATTENTION
Task: {1a88d4ae-cdaa-4a56-83de-23607ae574b0} - no filepath. <==== ATTENTION
Task: {1b032a02-8ebc-4f40-a33a-800ce85493a8} - no filepath. <==== ATTENTION
Task: {1db28d0a-89f3-4dcf-ac0f-c0be3d961f29} - no filepath. <==== ATTENTION
Task: {1e9218fe-d281-4631-90d5-76facb82d5d5} - no filepath. <==== ATTENTION
Task: {23be7dcc-ccf5-4ca1-a1c4-4e511827aec4} - no filepath. <==== ATTENTION
Task: {25c345ea-0eb6-4ca7-8358-9d7003492c6f} - no filepath. <==== ATTENTION
Task: {26c7b253-c4bf-4053-a65f-737682165aa2} - no filepath. <==== ATTENTION
Task: {28513f69-60da-4b1c-852d-9238ddb9c3a1} - no filepath. <==== ATTENTION
Task: {2922c57c-803b-4c37-8de9-7b83b19ebe1e} - no filepath. <==== ATTENTION
Task: {2b45ab69-3535-49b2-b9db-609e2d3c9853} - no filepath. <==== ATTENTION
Task: {2de0916e-033f-49c6-b6b0-b787cfd5113b} - no filepath. <==== ATTENTION
Task: {314d2540-d142-4344-9000-0950639c7228} - no filepath. <==== ATTENTION
Task: {316a3549-2090-4c06-ab8d-902372ed768c} - no filepath. <==== ATTENTION
Task: {316e6970-ebbb-4b58-a5b4-4384d95e3eed} - no filepath. <==== ATTENTION
Task: {333118e1-d59b-4f67-af8c-cd63c61f0d13} - no filepath. <==== ATTENTION
Task: {34fb8307-c429-4d6c-9463-50d4852629fe} - no filepath. <==== ATTENTION
Task: {3e0fd6c6-6811-4632-b04b-0cbae9f4d5b6} - no filepath. <==== ATTENTION
Task: {419a8a3c-9fab-4af4-9752-d256e5155606} - no filepath. <==== ATTENTION
Task: {42d617c1-c911-45bb-aba1-13eca861f0b3} - no filepath. <==== ATTENTION
Task: {4b722e88-b3e4-4b3a-ade5-daf253e8a71c} - no filepath. <==== ATTENTION
Task: {4d7ec16b-eed9-45f8-8fea-79537c0b28ef} - no filepath. <==== ATTENTION
Task: {4eec1900-1e90-4206-82b1-6cb576abad54} - no filepath. <==== ATTENTION
Task: {4f13e7bf-9530-4725-8e90-574a425477df} - no filepath. <==== ATTENTION
Task: {4f7a2c4e-6d0f-4c81-b437-f7cd295a7828} - no filepath. <==== ATTENTION
Task: {5251b615-dd7d-4405-8829-0386abbaf963} - no filepath. <==== ATTENTION
Task: {53b1c3a0-49e1-410e-a5f0-6604a99483b4} - no filepath. <==== ATTENTION
Task: {55b546e2-b84d-4c64-bc65-c82f41077eb6} - no filepath. <==== ATTENTION
Task: {59366d01-27ce-4c0e-ac51-04c1938584e8} - no filepath. <==== ATTENTION
Task: {5975fa46-b990-4bea-9c1f-a69fe38527a3} - no filepath. <==== ATTENTION
Task: {5ab579c6-4f18-4dfc-95d2-fd2ab79c222d} - no filepath. <==== ATTENTION
Task: {5bb4dbc6-7ad9-43da-add3-464563c26f44} - no filepath. <==== ATTENTION
Task: {5c48f15f-167e-470d-9e29-05eb9f964edc} - no filepath. <==== ATTENTION
Task: {5e6fcbe3-7f15-43f2-a542-3f91f5d8d919} - no filepath. <==== ATTENTION
Task: {5f086daa-bd25-4997-99fd-197365c5aaca} - no filepath. <==== ATTENTION
Task: {61c91b46-640c-48f7-9218-4e919e989eac} - no filepath. <==== ATTENTION
Task: {64381a3f-5678-4c3d-ae13-991c946b9741} - no filepath. <==== ATTENTION
Task: {68321c9a-87ea-4f59-8b78-2dd9e6ea8033} - no filepath. <==== ATTENTION
Task: {6bc1aa7c-3ee7-4350-bbcf-709708854264} - no filepath. <==== ATTENTION
Task: {72fd4cd5-c907-41f1-b979-b73c11539100} - no filepath. <==== ATTENTION
Task: {739ee079-6bdb-4264-a5f4-cc0589decc3d} - no filepath. <==== ATTENTION
Task: {73a21312-2742-4f01-85e6-0814eaddd948} - no filepath. <==== ATTENTION
Task: {82560250-d089-43b1-b818-9317804de954} - no filepath. <==== ATTENTION
Task: {85d70944-b765-4918-bd4d-0cc38496d34f} - no filepath. <==== ATTENTION
Task: {86afefe5-1b42-4b78-952d-77de3aeb8a5c} - no filepath. <==== ATTENTION
Task: {87151256-9df1-4d13-b5e0-a8449f94c3e1} - no filepath. <==== ATTENTION
Task: {87447dd3-0e52-4a8a-a4d2-f0000e4f86c5} - no filepath. <==== ATTENTION
Task: {87b7ee90-365e-407b-b9ca-2649baa8b145} - no filepath. <==== ATTENTION
Task: {8bec09a4-90fc-4b11-b83c-75cd44aec1ed} - no filepath. <==== ATTENTION
Task: {8d0a6257-8007-4fae-8bc4-d4f35396ed0c} - no filepath. <==== ATTENTION
Task: {8d946d22-1aab-44a0-a20f-13f2376466e0} - no filepath. <==== ATTENTION
Task: {9012ae4c-8904-4860-9ce3-b5c703503ebf} - no filepath. <==== ATTENTION
Task: {90ac0103-f8fb-4001-a151-34b7ace065db} - no filepath. <==== ATTENTION
Task: {94d34f5d-176e-4d2c-8973-8711deaf05de} - no filepath. <==== ATTENTION
Task: {958e970e-c2b1-4d3b-b0df-43aee8d76167} - no filepath. <==== ATTENTION
Task: {9647bee6-44b8-4bbe-87fe-e4d34f83d044} - no filepath. <==== ATTENTION
Task: {9a2d9ce6-5363-4812-8476-2232666352ac} - no filepath. <==== ATTENTION
Task: {9c97925a-c2fd-4d45-ace4-c63617eaa11e} - no filepath. <==== ATTENTION
Task: {9e68122d-01b8-411b-8a07-a6da1b55184e} - no filepath. <==== ATTENTION
Task: {9f56a7c4-d04e-479a-b90b-4067d5717e24} - no filepath. <==== ATTENTION
Task: {9f6726e2-5c0e-4abd-b0f9-4b38bf219054} - no filepath. <==== ATTENTION
Task: {a126dc8f-e475-4dc1-9870-b47b13cdc707} - no filepath. <==== ATTENTION
Task: {a29d59ae-e9f8-448c-8ddd-ccd90f5ea038} - no filepath. <==== ATTENTION
Task: {a52479cc-a6e5-4e8a-928c-efbad30eef7b} - no filepath. <==== ATTENTION
Task: {a6b69e9a-9179-42ae-87c8-53650f47a347} - no filepath. <==== ATTENTION
Task: {a6d6fc41-4842-4049-80a2-3ad1a8c674aa} - no filepath. <==== ATTENTION
Task: {a7576623-3376-42b6-9a36-ffa692263c37} - no filepath. <==== ATTENTION
Task: {ab8e714e-6e90-4842-9b9b-3dea1f7831b9} - no filepath. <==== ATTENTION
Task: {ac4ade29-d485-49c9-b6b4-0a14b5b59aa2} - no filepath. <==== ATTENTION
Task: {ac96b9c0-e9a4-4c99-bdbe-c2a2cbb3b1ca} - no filepath. <==== ATTENTION
Task: {b1f20959-93a2-4448-a4d7-b5bbe567361f} - no filepath. <==== ATTENTION
Task: {b2e7a2e0-e86e-4ccd-a2aa-35b8dfe0147e} - no filepath. <==== ATTENTION
Task: {b432ae29-d139-4490-b65e-ea6bf000444d} - no filepath. <==== ATTENTION
Task: {b5dac897-8c55-4026-93d7-ae383d062170} - no filepath. <==== ATTENTION
Task: {befd0b3a-8998-4b37-aa75-ee6861adc43b} - no filepath. <==== ATTENTION
Task: {c03ccd5c-ee6c-4e19-8370-e52c1086ac36} - no filepath. <==== ATTENTION
Task: {c1d01777-27e9-47c0-8485-c44ac7d46b21} - no filepath. <==== ATTENTION
Task: {c5255cb3-dd8d-4724-93f0-832b0c753dc1} - no filepath. <==== ATTENTION
Task: {c5cf9872-1983-4636-bc7d-e6a6e4f21ff6} - no filepath. <==== ATTENTION
Task: {c60cedae-5ff9-4884-a80d-59fac7fed721} - no filepath. <==== ATTENTION
Task: {c618491d-de5e-464b-b26e-dc91def36958} - no filepath. <==== ATTENTION
Task: {c7f2fd64-6863-49cb-9004-813294b7cdd5} - no filepath. <==== ATTENTION
Task: {c80e8c16-dc95-468b-ba0e-65284c71baac} - no filepath. <==== ATTENTION
Task: {c8696c27-7c65-4d52-ae7b-2d7d075e53bb} - no filepath. <==== ATTENTION
Task: {cdbadcb0-6c42-4a71-8714-b0d13eb1d6d8} - no filepath. <==== ATTENTION
Task: {ce7610f1-d731-409d-8877-cc8ba0255973} - no filepath. <==== ATTENTION
Task: {d2ad9cde-cbd8-445d-9413-616fe2a29746} - no filepath. <==== ATTENTION
Task: {d3a42d70-a220-443c-bdb2-4ca27b1aa748} - no filepath. <==== ATTENTION
Task: {d3ec0670-0cf7-477e-a4b0-920a07e201d4} - no filepath. <==== ATTENTION
Task: {d6386ecd-525c-443a-9c65-d3c2e56c9b9c} - no filepath. <==== ATTENTION
Task: {d78b1012-6ea4-4366-ae2c-f7dd38680dbc} - no filepath. <==== ATTENTION
Task: {d80aadf0-7b7f-443e-8cfe-e4c309c88fb4} - no filepath. <==== ATTENTION
Task: {d93ff2a9-8d32-4ee2-8373-6863606ee8ac} - no filepath. <==== ATTENTION
Task: {da95b201-4a26-4d0a-879c-29631b8ec0c0} - no filepath. <==== ATTENTION
Task: {df83c2b7-ed7d-432a-b63f-3b9d0f24bbfe} - no filepath. <==== ATTENTION
Task: {dfbe650e-5c81-4bb4-a693-c9a3ac763df1} - no filepath. <==== ATTENTION
Task: {e35497d4-35ec-42a0-8e70-ae21ba7ee294} - no filepath. <==== ATTENTION
Task: {e7b7d723-afef-486b-baaf-edcaf1797bae} - no filepath. <==== ATTENTION
Task: {e7ffbc77-acf5-47f2-89fd-353512ff09b0} - no filepath. <==== ATTENTION
Task: {ebef25a4-d2f4-4fc0-a453-515c98e488e6} - no filepath. <==== ATTENTION
Task: {ee1c46b2-f3d0-4d4b-b467-bf22b9b62d86} - no filepath. <==== ATTENTION
Task: {f3768fc6-5870-4aeb-8ff4-bc9e49f48c4c} - no filepath. <==== ATTENTION
Task: {f59d7fe0-bcc7-41bc-86e3-13d4e81b102b} - no filepath. <==== ATTENTION
Task: {fcc6732c-46ea-4fef-92aa-722e1a9b8a5b} - no filepath. <==== ATTENTION
Task: {fce6db1d-69ce-4ad1-8a79-c7cb086d5540} - no filepath. <==== ATTENTION
Task: {fe2950dc-41e6-44c2-ba7b-1640a11b58cb} - no filepath. <==== ATTENTION
S3 EAAntiCheat; system32\drivers\eaanticheat.sys [X]
S3 HWiNFO_191; \??\C:\Users\dimax\AppData\Local\Temp\HWiNFO64A_191.SYS [X] <==== ATTENTION
S3 NEProtect; \??\D:\Program Files\Games\LostLight\Engine\Binaries\Win64\NEProtect.sys [X]
AlternateDataStreams: C:\Users\dimax\Application Data:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\dimax\AppData\Roaming:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\Public\Documents\install-log-admin.txt:C78B9AA6F5 [3434]
FirewallRules: [TCP Query User{A05527A9-301B-4660-87D4-6F96A435A7E3}D:\program files\games\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) D:\program files\games\baldurs gate 3\bin\bg3_dx11.exe => No File
FirewallRules: [UDP Query User{B83007AF-148B-441F-B1B8-A9FA268759E1}D:\program files\games\baldurs gate 3\bin\bg3_dx11.exe] => (Allow) D:\program files\games\baldurs gate 3\bin\bg3_dx11.exe => No File
FirewallRules: [TCP Query User{6007A11A-DB08-448C-91A8-045BEC94BC7A}C:\program files\docker\docker\resources\com.docker.backend.exe] => (Allow) C:\program files\docker\docker\resources\com.docker.backend.exe => No File
FirewallRules: [UDP Query User{1932617E-2E44-4CD0-BAE7-84C667E66B3A}C:\program files\docker\docker\resources\com.docker.backend.exe] => (Allow) C:\program files\docker\docker\resources\com.docker.backend.exe => No File
FirewallRules: [TCP Query User{AA730322-4384-46D8-BDBE-4C56BD5C86A5}D:\program files\games\baldurs gate 3\bin\bg3_dx11.exe] => (Block) D:\program files\games\baldurs gate 3\bin\bg3_dx11.exe => No File
FirewallRules: [UDP Query User{FDE38786-7192-4788-8CF2-47718C8A7B0C}D:\program files\games\baldurs gate 3\bin\bg3_dx11.exe] => (Block) D:\program files\games\baldurs gate 3\bin\bg3_dx11.exe => No File
FirewallRules: [TCP Query User{7B8AD5D0-8C82-49FE-8109-CAB4CBD813F0}C:\program files\docker\docker\resources\com.docker.backend.exe] => (Allow) C:\program files\docker\docker\resources\com.docker.backend.exe => No File
FirewallRules: [UDP Query User{ECC2B3A4-23B1-441B-A19D-7FBA1199BEC5}C:\program files\docker\docker\resources\com.docker.backend.exe] => (Allow) C:\program files\docker\docker\resources\com.docker.backend.exe => No File
FirewallRules: [TCP Query User{24A989D1-9FAA-4A85-9040-28E27E031B8A}D:\program files (x86)\vidalia relay bundle\tor\tor.exe] => (Allow) D:\program files (x86)\vidalia relay bundle\tor\tor.exe => No File
FirewallRules: [UDP Query User{8292389C-20C2-4732-9795-3D6439D121D1}D:\program files (x86)\vidalia relay bundle\tor\tor.exe] => (Allow) D:\program files (x86)\vidalia relay bundle\tor\tor.exe => No File
FirewallRules: [TCP Query User{57C173D9-BCAD-4810-844C-AE0E5530F867}D:\program files\games\project zomboid\jre64\bin\java.exe] => (Allow) D:\program files\games\project zomboid\jre64\bin\java.exe => No File
FirewallRules: [UDP Query User{AF0FFC6F-BD9D-4924-833D-AF7B7E8766D6}D:\program files\games\project zomboid\jre64\bin\java.exe] => (Allow) D:\program files\games\project zomboid\jre64\bin\java.exe => No File
FirewallRules: [TCP Query User{18F71E41-0911-4A0E-9828-47FD50259AC6}D:\program files\games\project zomboid\projectzomboid64.exe] => (Allow) D:\program files\games\project zomboid\projectzomboid64.exe => No File
FirewallRules: [UDP Query User{6E5EFBF1-DF9D-468F-ACA5-479FFF0DCEF0}D:\program files\games\project zomboid\projectzomboid64.exe] => (Allow) D:\program files\games\project zomboid\projectzomboid64.exe => No File
FirewallRules: [TCP Query User{6151935B-3D0A-47A2-8802-DC917DAEF5FC}D:\program files\games\carcassonne the official board game\carcassonne.exe] => (Allow) D:\program files\games\carcassonne the official board game\carcassonne.exe => No File
FirewallRules: [UDP Query User{C27D2594-48A2-4DF2-AB91-F227A31F27F6}D:\program files\games\carcassonne the official board game\carcassonne.exe] => (Allow) D:\program files\games\carcassonne the official board game\carcassonne.exe => No File
FirewallRules: [TCP Query User{9417E8EF-A2F1-4C56-BB89-A6707025C16B}D:\program files\games\lostlight\engine\binaries\win64\game_x64r.exe] => (Allow) D:\program files\games\lostlight\engine\binaries\win64\game_x64r.exe => No File
FirewallRules: [UDP Query User{DD365110-D286-487C-9E96-3561C222C126}D:\program files\games\lostlight\engine\binaries\win64\game_x64r.exe] => (Allow) D:\program files\games\lostlight\engine\binaries\win64\game_x64r.exe => No File
FirewallRules: [TCP Query User{A1DB5237-6950-4202-A771-59A5983E0250}D:\program files\games\lostlight\engine\binaries\win64\cc\ccmini.exe] => (Allow) D:\program files\games\lostlight\engine\binaries\win64\cc\ccmini.exe => No File
FirewallRules: [UDP Query User{26CB7F5F-8405-442F-9225-4D1E861FC257}D:\program files\games\lostlight\engine\binaries\win64\cc\ccmini.exe] => (Allow) D:\program files\games\lostlight\engine\binaries\win64\cc\ccmini.exe => No File
FirewallRules: [TCP Query User{FD77B314-A48C-4468-878E-51AFFD49674E}D:\program files (x86)\steam\steamapps\common\battlefield 4\bf4.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\battlefield 4\bf4.exe => No File
FirewallRules: [UDP Query User{668BFA98-9669-46F1-B901-273A817E0D6F}D:\program files (x86)\steam\steamapps\common\battlefield 4\bf4.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\battlefield 4\bf4.exe => No File
FirewallRules: [TCP Query User{9BEDAE1D-8BE1-41E2-B123-A78D6D08C289}D:\program files\games\starcraft ii\versions\base91115\sc2_x64.exe] => (Allow) D:\program files\games\starcraft ii\versions\base91115\sc2_x64.exe => No File
FirewallRules: [UDP Query User{0F442238-F02C-4749-A0F8-36A5568D2AE7}D:\program files\games\starcraft ii\versions\base91115\sc2_x64.exe] => (Allow) D:\program files\games\starcraft ii\versions\base91115\sc2_x64.exe => No File
FirewallRules: [TCP Query User{6557382A-A125-4BCE-866F-FAEEAE8885F6}D:\program files\games\starcraft ii\versions\base92028\sc2_x64.exe] => (Allow) D:\program files\games\starcraft ii\versions\base92028\sc2_x64.exe => No File
FirewallRules: [UDP Query User{523FA0C4-E1A9-4F5C-BAB4-2A9B0A7F9015}D:\program files\games\starcraft ii\versions\base92028\sc2_x64.exe] => (Allow) D:\program files\games\starcraft ii\versions\base92028\sc2_x64.exe => No File
FirewallRules: [TCP Query User{BF4386E5-B612-4AAE-B146-7CEF39E353C6}D:\program files\games\terraria v1.4.4.9 v4\terraria.exe] => (Allow) D:\program files\games\terraria v1.4.4.9 v4\terraria.exe => No File
FirewallRules: [UDP Query User{FD751DFC-524C-4749-94D2-9ACBEB6DFE2E}D:\program files\games\terraria v1.4.4.9 v4\terraria.exe] => (Allow) D:\program files\games\terraria v1.4.4.9 v4\terraria.exe => No File
FirewallRules: [TCP Query User{73693EFE-8E65-4FD9-B4CC-F5E3B3A67D44}D:\program files\games\terraria v1.4.4.9 v4\terrariaserver.exe] => (Allow) D:\program files\games\terraria v1.4.4.9 v4\terrariaserver.exe => No File
FirewallRules: [UDP Query User{79F24D6F-68C9-45A0-9023-DBE8889B441D}D:\program files\games\terraria v1.4.4.9 v4\terrariaserver.exe] => (Allow) D:\program files\games\terraria v1.4.4.9 v4\terrariaserver.exe => No File
FirewallRules: [TCP Query User{0C2FC5A8-7CE3-44BC-86E3-8E762AA6EE00}D:\program files\games\city car driving\bin\win32\starter.exe] => (Allow) D:\program files\games\city car driving\bin\win32\starter.exe => No File
FirewallRules: [UDP Query User{1FBE0A65-2857-45DC-A46B-009073D3891E}D:\program files\games\city car driving\bin\win32\starter.exe] => (Allow) D:\program files\games\city car driving\bin\win32\starter.exe => No File
FirewallRules: [TCP Query User{CE8F650A-449A-49FA-9590-382B1098079E}D:\program files\games\stronghold legends\strongholdlegends.exe] => (Block) D:\program files\games\stronghold legends\strongholdlegends.exe => No File
FirewallRules: [UDP Query User{C38C95D3-7E07-4CE2-B107-C1775AA9D210}D:\program files\games\stronghold legends\strongholdlegends.exe] => (Block) D:\program files\games\stronghold legends\strongholdlegends.exe => No File
FirewallRules: [TCP Query User{E0E1D72A-3B7B-4D7F-8B74-041DFB465E4D}D:\program files\games\stronghold 3.v 1.10.27781 + 6 dlc\bin\win32_release\stronghold3.exe] => (Block) D:\program files\games\stronghold 3.v 1.10.27781 + 6 dlc\bin\win32_release\stronghold3.exe => No File
FirewallRules: [UDP Query User{74753DE0-C1D2-4170-B2C5-2A2439DE45FE}D:\program files\games\stronghold 3.v 1.10.27781 + 6 dlc\bin\win32_release\stronghold3.exe] => (Block) D:\program files\games\stronghold 3.v 1.10.27781 + 6 dlc\bin\win32_release\stronghold3.exe => No File
FirewallRules: [TCP Query User{3E3931CB-EECF-478D-944D-8EB99FBAFB8B}D:\program files\games\stronghold 3.v 1.10.27781 + 6 dlc\bin\win32_release\mapeditor.exe] => (Block) D:\program files\games\stronghold 3.v 1.10.27781 + 6 dlc\bin\win32_release\mapeditor.exe => No File
FirewallRules: [UDP Query User{829059CE-E409-43D9-9EAE-5958B33B6547}D:\program files\games\stronghold 3.v 1.10.27781 + 6 dlc\bin\win32_release\mapeditor.exe] => (Block) D:\program files\games\stronghold 3.v 1.10.27781 + 6 dlc\bin\win32_release\mapeditor.exe => No File
FirewallRules: [TCP Query User{0254D953-73B1-4AA3-8334-8EC1DB42F380}D:\program files (x86)\steam\steamapps\common\war thunder\win64\aces.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\war thunder\win64\aces.exe => No File
FirewallRules: [UDP Query User{A864929A-E73E-4B33-8CFE-B58BDB1C1C5F}D:\program files (x86)\steam\steamapps\common\war thunder\win64\aces.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\war thunder\win64\aces.exe => No File
FirewallRules: [TCP Query User{905B6C96-8E62-4C9F-81F9-B843EFA41BE1}D:\program files (x86)\steam\steamapps\common\war thunder\win64\cefprocess.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\war thunder\win64\cefprocess.exe => No File
FirewallRules: [UDP Query User{C3E4735B-0290-49D4-9E46-A38B2FF3380A}D:\program files (x86)\steam\steamapps\common\war thunder\win64\cefprocess.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\war thunder\win64\cefprocess.exe => No File
FirewallRules: [{26418B58-81BC-4E84-A993-06168AD27C47}] => (Allow) D:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win64\RocketLeague.exe => No File
FirewallRules: [{2C853AD0-4FA6-423F-B574-9DB59A58F20C}] => (Allow) D:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win64\RocketLeague.exe => No File
FirewallRules: [TCP Query User{8EB31E73-E5FF-4EFB-8D49-4B47C20501A6}D:\program files\games\farming simulator 25\x64\farmingsimulator2025game.exe] => (Allow) D:\program files\games\farming simulator 25\x64\farmingsimulator2025game.exe => No File
FirewallRules: [UDP Query User{8B41509A-ACA3-483F-A6EA-6BD21DFFFADC}D:\program files\games\farming simulator 25\x64\farmingsimulator2025game.exe] => (Allow) D:\program files\games\farming simulator 25\x64\farmingsimulator2025game.exe => No File
Reboot:
End::

2. Запустите Farbar Recovery Scan Tool от имени Администратора по правой кнопке мыши.
3. Нажмите один раз на кнопку Fix (Исправить) и подождите. Программа создаст лог-файл (Fixlog.txt). Пожалуйста, прикрепите его в следующем сообщении.

• Обратите внимание: будет выполнена перезагрузка компьютера.
  

 

[ДмитрийКасперскийКлуб]

Спасибо, выполнил.

Fixlog.txt

[thyrex]

Проблема решена?

[ДмитрийКасперскийКлуб]

Насколько понимаю, да, реклама больше не появлялась при перезагрузке. Огромное спасибо, выручили!

[thyrex]

Загрузите SecurityCheck by glax24 & Severnyj и сохраните архив на Рабочем столе.

• Разархивируйте, запустите двойным щелчком мыши (если Вы используете Windows XP) или из меню по щелчку правой кнопки мыши Запустить от имени администратора (если Вы используете Windows Vista/7/8/10/11);
• Если увидите предупреждение от вашего фаервола относительно программы SecurityCheck, не блокируйте ее работу;
• Дождитесь окончания сканирования, откроется лог в Блокноте с именем SecurityCheck.txt;
• Если Вы закрыли Блокнот, то найти этот файл можно в корне системного диска в папке с именем SecurityCheck, например C:\SecurityCheck\SecurityCheck.txt;
• Прикрепите этот файл в своем следующем сообщении.

 

[ДмитрийКасперскийКлуб]

Прикрепляю.

SecurityCheck.txt

[thyrex]

По возможности исправьте:

 

CrystalDiskInfo 9.1.1 v.9.1.1 Warning! Download Update
Git v.2.42.0.2 Warning! Download Update
HWiNFO64 v.7.72 Warning! Download Update
Oracle VM VirtualBox 7.0.14 v.7.0.14 Warning! Download Update
PuTTY release 0.81 (64-bit) v.0.81.0.0 Warning! Download Update
FileZilla 3.66.1 v.3.66.1 Warning! Download Update
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.40.33810 v.14.40.33810.0 Warning! Download Update
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.40.33810 v.14.40.33810.0 Warning! Download Update
7-Zip 23.01 (x64) v.23.01 Warning! Download Update
Uninstall old version and install new one.
paint.net v.5.0.13 Warning! Download Update
Discord v.1.0.9003 Warning! Download Update
qBittorrent v.4.6.0 Warning! Download Update
Tribler v.7.13.0 Warning! Download Update
Java 8 Update 391 (64-bit) v.8.0.3910.13 Warning! Download Update
Uninstall old version and install new one (jre-8u431-windows-x64.exe).
Mozilla Thunderbird (x64 ru) v.128.4.3 Warning! Download Update
 

На этом закончим.

[ДмитрийКасперскийКлуб]

Благодарю!

[thyrex]

Мы были рады Вам помочь! Надеемся, что Вы остались довольны результатом. На нашем форуме также можно получить компьютерную помощь, помощь по продуктам "Лаборатории Касперкого", обсудить технологии и технику, заказать эксклюзивную сувенирную продукцию "Лаборатории Касперского" бесплатно! Форумчане ежегодно путешествуют. В числе приглашенных в Турцию, Армению, Сочи, Камбоджу можете стать и Вы! Будем рады видеть Вас в наших рядах! Всегда ваш, клуб "Лаборатории Касперского".