Подозрение на BitCoinMiner

29 июня, 2017

Сделайте свежие логи FRST

29 июня, 2017

Про политики я вас выше спрашивал, но всё-таки на всякий случай

1) Создайте точку восстановления системы.

2)

Отключите до перезагрузки антивирус.

Выделите следующий код:

Start::
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\system: [NoDispCPL] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\system: [NoDispBackgroundPage] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\system: [NoDispScrSavPage] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\system: [NoDispSettingsPage] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\system: [NoColorChoice] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\system: [HideLogonScripts] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\system: [HideLogoffScripts] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\system: [HideLegacyLogonScripts] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoThemesTab] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoAddPrinter] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [RestrictCpl] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [DisallowCpl] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoViewOnDrive] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoDrivesInSendToMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [RestrictRun] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [DisallowRun] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoRecycleFiles] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [PreventItemCreationInUsersFilesFolder] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoReadingPane] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoPreviewPane] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [DontSetAutoplayCheckbox] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoPropertiesMyDocuments] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoPropertiesRecycleBin] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoManageMyComputerVerb] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [ClassicShell] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoCustomizeWebView] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoFileMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoWinKeys] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoSecurityTab] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [DisableThumbnails] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [DisableThumbnailsOnNetworkFolders] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoInstrumentation] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoCustomizeThisFolder] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoWebView] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [DontShowSuperHidden] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoOnlinePrintsWizard] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoPublishingWizard] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [AlwaysShowClassicMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [ClearRecentProgForNewUserInStartMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoUserFolderInStartMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoSearchComputerLinkInStartMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoSearchProgramsInStartMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoSearchInternetInStartMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoSearchFilesInStartMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoSearchCommInStartMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoSMConfigurePrograms] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoRecentDocsMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoSMMyPictures] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoStartMenuMyMusic] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoSMMyDocs] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoStartMenuNetworkPlaces] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoFavoritesMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoHelp] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoNetworkConnections] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoFind] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoCommonGroups] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoStartMenuMFUprogramsList] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoStartMenuPinnedList] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoStartMenuMorePrograms] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoStartMenuEjectPC] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoSimpleStartMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [ForceStartMenuLogoff] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoDisconnect] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoNtSecurity] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoSetFolders] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [GreyMSIAds] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [ForceMaxRecentDocs] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoStartMenuMyGames] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoSMBalloonTip] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoSMBalloonTips] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [LockTaskbar] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [HideSCAVolume] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [HideSCANetwork] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [HideSCAPower] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [HideSCABattery] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoToolbarsOnTaskbar] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoTaskGrouping] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [TaskbarNoThumbnail] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [TaskbarLockAll] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [TaskbarNoResize] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [TaskbarNoAddRemoveToolbar] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [TaskbarNoDragToolbar] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [TaskbarNoRedock] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [RestrictWelcomeCenter] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoWebServices] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoFileUrl] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoInternetIcon] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoBandCustomize] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoToolbarCustomize] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [SpecifyDefaultButtons] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoInplaceSharing] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoNetHood] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoNetConnectDisconnect] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [UseFoldersInStartMenu] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [TurnOffSPIAnimations] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [EnforceShellExtensionSecurity] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoLogOff] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [PromptRunasInstallNetPath] 1
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoDesktopCleanupWizard] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NoThumbnailCache] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [ForceCopyAclwithFile] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [StartRunNoHOMEPATH] 0
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\...\Policies\Explorer: [NolowDiskSpaceChecks] 1
HKU\S-1-5-18\...\Policies\system: [NoDispCPL] 0
HKU\S-1-5-18\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-18\...\Policies\system: [NoDispBackgroundPage] 0
HKU\S-1-5-18\...\Policies\system: [NoDispScrSavPage] 0
HKU\S-1-5-18\...\Policies\system: [NoDispSettingsPage] 0
HKU\S-1-5-18\...\Policies\system: [NoColorChoice] 0
HKU\S-1-5-18\...\Policies\system: [DontDisplayLogonHoursWarnings] 0
HKU\S-1-5-18\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-18\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-18\...\Policies\system: [HideLogonScripts] 0
HKU\S-1-5-18\...\Policies\system: [HideLogoffScripts] 0
HKU\S-1-5-18\...\Policies\system: [HideLegacyLogonScripts] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoThemesTab] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoAddPrinter] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-18\...\Policies\Explorer: [RestrictCpl] 0
HKU\S-1-5-18\...\Policies\Explorer: [DisallowCpl] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoViewOnDrive] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoDrivesInSendToMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [RestrictRun] 0
HKU\S-1-5-18\...\Policies\Explorer: [DisallowRun] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoRecycleFiles] 0
HKU\S-1-5-18\...\Policies\Explorer: [PreventItemCreationInUsersFilesFolder] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoReadingPane] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoPreviewPane] 0
HKU\S-1-5-18\...\Policies\Explorer: [DontSetAutoplayCheckbox] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoPropertiesMyDocuments] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoPropertiesRecycleBin] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoManageMyComputerVerb] 0
HKU\S-1-5-18\...\Policies\Explorer: [ClassicShell] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoCustomizeWebView] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoFileMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoWinKeys] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSecurityTab] 0
HKU\S-1-5-18\...\Policies\Explorer: [DisableThumbnails] 0
HKU\S-1-5-18\...\Policies\Explorer: [DisableThumbnailsOnNetworkFolders] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoInstrumentation] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoCustomizeThisFolder] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoWebView] 0
HKU\S-1-5-18\...\Policies\Explorer: [DontShowSuperHidden] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoOnlinePrintsWizard] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoPublishingWizard] 0
HKU\S-1-5-18\...\Policies\Explorer: [AlwaysShowClassicMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [ClearRecentProgForNewUserInStartMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoUserFolderInStartMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSearchComputerLinkInStartMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSearchProgramsInStartMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSearchInternetInStartMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSearchFilesInStartMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSearchCommInStartMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSMConfigurePrograms] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoRecentDocsMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSMMyPictures] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoStartMenuMyMusic] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSMMyDocs] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoStartMenuNetworkPlaces] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoFavoritesMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoHelp] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoNetworkConnections] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoFind] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoCommonGroups] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoStartMenuMFUprogramsList] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoStartMenuPinnedList] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoStartMenuMorePrograms] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoStartMenuEjectPC] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSimpleStartMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [ForceStartMenuLogoff] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoDisconnect] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoNtSecurity] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSetFolders] 0
HKU\S-1-5-18\...\Policies\Explorer: [GreyMSIAds] 0
HKU\S-1-5-18\...\Policies\Explorer: [ForceMaxRecentDocs] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoStartMenuMyGames] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSMBalloonTip] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSMBalloonTips] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-18\...\Policies\Explorer: [LockTaskbar] 0
HKU\S-1-5-18\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-18\...\Policies\Explorer: [HideSCAVolume] 0
HKU\S-1-5-18\...\Policies\Explorer: [HideSCANetwork] 0
HKU\S-1-5-18\...\Policies\Explorer: [HideSCAPower] 0
HKU\S-1-5-18\...\Policies\Explorer: [HideSCABattery] 0
HKU\S-1-5-18\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoToolbarsOnTaskbar] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoTaskGrouping] 0
HKU\S-1-5-18\...\Policies\Explorer: [TaskbarNoThumbnail] 0
HKU\S-1-5-18\...\Policies\Explorer: [TaskbarLockAll] 0
HKU\S-1-5-18\...\Policies\Explorer: [TaskbarNoResize] 0
HKU\S-1-5-18\...\Policies\Explorer: [TaskbarNoAddRemoveToolbar] 0
HKU\S-1-5-18\...\Policies\Explorer: [TaskbarNoDragToolbar] 0
HKU\S-1-5-18\...\Policies\Explorer: [TaskbarNoRedock] 0
HKU\S-1-5-18\...\Policies\Explorer: [RestrictWelcomeCenter] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoWebServices] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoFileUrl] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoInternetIcon] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoBandCustomize] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoToolbarCustomize] 0
HKU\S-1-5-18\...\Policies\Explorer: [SpecifyDefaultButtons] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoInplaceSharing] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoNetHood] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoNetConnectDisconnect] 0
HKU\S-1-5-18\...\Policies\Explorer: [UseFoldersInStartMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [TurnOffSPIAnimations] 0
HKU\S-1-5-18\...\Policies\Explorer: [EnforceShellExtensionSecurity] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoLogOff] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-18\...\Policies\Explorer: [PromptRunasInstallNetPath] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-18\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoDesktopCleanupWizard] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoThumbnailCache] 0
HKU\S-1-5-18\...\Policies\Explorer: [ForceCopyAclwithFile] 0
HKU\S-1-5-18\...\Policies\Explorer: [StartRunNoHOMEPATH] 0
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} =>  -> No File
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} =>  -> No File
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
HKU\S-1-5-21-829811392-3687614389-1353428902-1004\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
S4 MinerGate; "C:\ProgramData\Framework\System.exe" [X] <==== ATTENTION
2017-03-01 11:34 - 2017-03-01 11:34 - 0000048 ____H () C:\Program Files (x86)\bcoigplwey.dat
2017-03-05 05:26 - 2017-03-25 10:02 - 0000132 _____ () C:\Users\1\AppData\Roaming\Установки формата PNG Adobe CS6
2016-08-26 08:15 - 2016-08-26 08:15 - 0000000 ___SH () C:\Users\1\AppData\Local\LumaEmu
2016-11-01 23:47 - 2016-11-01 23:47 - 0007601 _____ () C:\Users\1\AppData\Local\Resmon.ResmonCfg
2017-04-25 19:27 - 2017-04-25 19:27 - 0000061 _____ () C:\Users\1\AppData\Local\TempGameCenter.main.download.log
2016-06-22 21:43 - 2016-06-22 21:43 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2017-06-26 13:12 - 2017-06-26 13:12 - 0000016 _____ () C:\ProgramData\mntemp
2016-12-15 17:18 - 2017-01-23 17:52 - 0005110 _____ () C:\ProgramData\NvTelemetryContainer.log_backup1
Task: {04A3DBB7-AA2B-45E5-ABEA-B989B5CDA25F} - \ASCU10_SkipUac_1 -> No File <==== ATTENTION
Task: {39D0FEB9-9893-44BB-BCB5-69D7C50A59FD} - \MSI -> No File <==== ATTENTION
Task: {56E4A07D-2FFA-48BD-8C6D-F9D8C7452E93} - \Realtek -> No File <==== ATTENTION
Task: {938EA342-FD69-4245-BA2C-07B0C76F5030} - \ASCU10_SkipUac_123 -> No File <==== ATTENTION
Task: {AEAB84CE-B7E0-43C1-89CA-E084F09A4EA6} - \ijhg -> No File <==== ATTENTION
Task: {D95F3ECC-BCE4-497E-82CB-ED86B52E4B24} - \Driver Booster SkipUAC (1) -> No File <==== ATTENTION
EmptyTemp:
Reboot:
End::

Скопируйте выделенный текст (правой кнопкой - Копировать).
Запустите FRST (FRST64) от имени администратора.
Нажмите Fix и подождите. Программа создаст лог-файл (Fixlog.txt). Прикрепите его к своему следующему сообщению.

Компьютер будет перезагружен автоматически.

29 июня, 2017

Программа создаст лог-файл (Fixlog.txt). Прикрепите его к своему следующему сообщению.

29 июня, 2017

1) Точку восстановления создали?

2) Что с проблемой?

29 июня, 2017

1) Не создавал. Восстановление системы отключено.

2) Пока не появляется.

Благодарю за помощь!

Как MBAM правильно удалить?

29 июня, 2017

Не создавал. Восстановление системы отключено.

И очень плохо.

Создайте хоть сейчас.

Выполните скрипт в AVZ при наличии доступа в интернет:

var
LogPath : string;
ScriptPath : string;

begin
 LogPath := GetAVZDirectory + 'log\avz_log.txt';
 if FileExists(LogPath) Then DeleteFile(LogPath);
 ScriptPath := GetAVZDirectory +'ScanVuln.txt';

  if DownloadFile('http://dataforce.ru/~kad/ScanVuln.txt', ScriptPath, 1) then ExecuteScript(ScriptPath) else begin
    if DownloadFile('http://dataforce.ru/~kad/ScanVuln.txt', ScriptPath, 0) then ExecuteScript(ScriptPath) else begin
       ShowMessage('Невозможно загрузить скрипт AVZ для обнаружения наиболее часто используемых уязвимостей!');
       exit;
      end;
  end;
 if FileExists(LogPath) Then ExecuteFile('notepad.exe', LogPath, 1, 0, false)
end.

После его работы, если будут найдены уязвимости, в блокноте откроется файл avz_log.txt со ссылками на обновления системы и критичных к безопасности программ, которые нужно загрузить и установить. В первую очередь это относится к Java Runtime Environment, Adobe Reader и Adobe Flash Player, это программы, уязвимостями в которых наиболее часто пользуются для внедрения зловредов в систему.

Выполните рекомендации после лечения.

29 июня, 2017

Как MBAM правильно удалить?

29 июня, 2017

@rustorkan, вы по моей ссылке внизу поста ходили? Там прямо в самом начале написан ваш вопрос и дана ссылка ответ на него.

А если вы не читаете и не выполняете рекомендации, то велика вероятность, что скоро снова вернётесь лечиться.

29 июня, 2017

@regist, уже прочел. Спасибо!

Подозрение на BitCoinMiner

Рекомендуемые сообщения

rustorkan

Ссылка на комментарий

Поделиться на другие сайты

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

regist

Ссылка на комментарий

Поделиться на другие сайты

rustorkan

Ссылка на комментарий

Поделиться на другие сайты

regist

Ссылка на комментарий

Поделиться на другие сайты

rustorkan

Ссылка на комментарий

Поделиться на другие сайты

regist

Ссылка на комментарий

Поделиться на другие сайты

rustorkan

Ссылка на комментарий

Поделиться на другие сайты

regist

Ссылка на комментарий

Поделиться на другие сайты

rustorkan

Ссылка на комментарий

Поделиться на другие сайты

Пожалуйста, войдите, чтобы комментировать

Похожий контент

Сайт

Активность

Магазин

Поддержка

Kaspersky Support Forum