[Sandor]

Здравствуйте!

Учётную запись

john (S-1-5-21-3189209215-2824803358-1535666637-1001 - Administrator - Enabled)

отключите и удалите.

Примите к сведению - после выполнения скрипта все открытые вкладки браузеров будут закрыты, произойдет выход из аккаунтов, временные файлы, корзина, история браузеров, куки и кэш будут очищены.

• Отключите до перезагрузки антивирус.
• Выделите следующий код:
  
  Код:

  Start::
  CreateRestorePoint:
  (Microsoft Corporation) [File not signed] C:\ProgramData\RunDLL\rundll.exe
  (Microsoft Corporation) [File not signed] C:\ProgramData\RunDLL\system.exe
  (Microsoft Corporation) [File not signed] C:\ProgramData\WindowsTask\audiodg.exe
  (Microsoft Corporation) [File not signed] C:\ProgramData\WindowsTask\MicrosoftHost.exe
  (Realtek Semiconductor) [File not signed] C:\ProgramData\RealtekHD\taskhostw.exe
  HKLM\...\Run: [Realtek HD Audio] => C:\ProgramData\RealtekHD\taskhostw.exe [2009600 2019-12-30] (Realtek Semiconductor) [File not signed] <==== ATTENTION
  HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
  HKU\S-1-5-21-3189209215-2824803358-1535666637-1000\...\MountPoints2: {02bfff56-764a-11ea-b410-00219707c780} - D:\HiSuiteDownLoader.exe
  HKU\S-1-5-18\...\Policies\Explorer: [DisallowRun] 1
  HKU\S-1-5-18\...\Policies\Explorer\DisallowRun: [1] eav_trial_rus.exe
  HKU\S-1-5-18\...\Policies\Explorer\DisallowRun: [2] avast_free_antivirus_setup_online.exe
  HKU\S-1-5-18\...\Policies\Explorer\DisallowRun: [3] eis_trial_rus.exe
  HKU\S-1-5-18\...\Policies\Explorer\DisallowRun: [4] essf_trial_rus.exe
  HKU\S-1-5-18\...\Policies\Explorer\DisallowRun: [5] hitmanpro_x64.exe
  HKU\S-1-5-18\...\Policies\Explorer\DisallowRun: [6] ESETOnlineScanner_UKR.exe
  HKU\S-1-5-18\...\Policies\Explorer\DisallowRun: [7] ESETOnlineScanner_RUS.exe
  HKU\S-1-5-18\...\Policies\Explorer\DisallowRun: [8] HitmanPro.exe
  HKU\S-1-5-18\...\Policies\Explorer\DisallowRun: [9] 360TS_Setup_Mini.exe
  HKU\S-1-5-18\...\Policies\Explorer\DisallowRun: [10] Cezurity_Scanner_Pro_Free.exe
  HKU\S-1-5-18\...\Policies\Explorer\DisallowRun: [11] Cube.exe
  S4 RManService; C:\ProgramData\Windows\rutserv.exe [1789440 2016-01-23] () [File not signed]
  2020-08-11 08:26 - 2020-08-11 08:26 - 000000000 ____D C:\ProgramData\SecTaskMan
  2020-08-11 08:56 - 2020-06-18 13:19 - 000000000 __SHD C:\ProgramData\RunDLL
  2020-06-18 13:20 - 2020-06-18 13:20 - 000000000 ___SH () C:\ProgramData\kz.exe
  2020-06-18 13:20 - 2020-06-18 13:20 - 000000000 ___SH () C:\ProgramData\lsass.exe
  2020-06-18 13:20 - 2020-06-18 13:20 - 000000000 ___SH () C:\ProgramData\lsass2.exe
  2020-06-18 13:20 - 2020-06-18 13:20 - 000000000 ___SH () C:\ProgramData\olly.exe
  2020-06-18 13:20 - 2020-06-18 13:20 - 000000000 ___SH () C:\ProgramData\script.exe
  2020-06-18 13:20 C:\AdwCleaner
  2020-06-18 13:20 C:\KVRT_Data
  2020-06-18 13:20 C:\Program Files\AVAST Software
  2020-06-18 13:20 C:\Program Files\AVG
  2020-06-18 13:20 C:\Program Files\ByteFence
  2020-06-18 13:20 C:\Program Files\Cezurity
  2020-06-18 13:20 C:\Program Files\COMODO
  2020-06-18 13:20 C:\Program Files\Enigma Software Group
  2020-06-18 13:20 C:\Program Files\ESET
  2020-06-18 13:20 C:\Program Files\Kaspersky Lab
  2020-06-18 13:20 C:\Program Files\Malwarebytes
  2020-06-18 13:20 C:\Program Files\SpyHunter
  2020-06-18 13:20 C:\Windows\boy.exe
  2020-06-18 13:20 C:\Windows\java.exe
  2020-06-18 13:20 C:\Windows\NetworkDistribution
  2020-06-18 13:20 C:\Windows\speechstracing
  2020-06-18 13:20 C:\Windows\svchost.exe
  2020-06-18 13:20 C:\ProgramData\360safe
  2020-06-18 13:20 C:\ProgramData\AVAST Software
  2020-06-18 13:20 C:\ProgramData\Avira
  2020-06-18 13:20 C:\ProgramData\Doctor Web
  2020-06-18 13:20 C:\ProgramData\Driver Foundation Visions VHG
  2020-06-18 13:20 C:\ProgramData\ESET
  2020-06-18 13:20 C:\ProgramData\grizzly
  2020-06-18 13:20 C:\ProgramData\Indus
  2020-06-18 13:20 C:\ProgramData\Kaspersky Lab
  2020-06-18 13:20 C:\ProgramData\Kaspersky Lab Setup Files
  2020-06-18 13:20 C:\ProgramData\kz.exe
  2020-06-18 13:20 C:\ProgramData\lsass.exe
  2020-06-18 13:20 C:\ProgramData\lsass2.exe
  2020-06-18 13:20 C:\ProgramData\Malwarebytes
  2020-06-18 13:20 C:\ProgramData\MB3Install
  2020-06-18 13:20 C:\ProgramData\McAfee
  2020-06-18 13:20 C:\ProgramData\Norton
  2020-06-18 13:20 C:\ProgramData\olly.exe
  2020-06-18 13:20 C:\ProgramData\script.exe
  C:\ProgramData\Windows\
  FCheck: C:\Windows\boy.exe [2020-06-18] <==== ATTENTION (Access Denied)
  FCheck: C:\Windows\java.exe [2020-06-18] <==== ATTENTION (Access Denied)
  FCheck: C:\Windows\svchost.exe [2020-06-18] <==== ATTENTION (Access Denied)
  Hosts:
  MSCONFIG\startupreg: Realtek HD Audio => C:\ProgramData\RealtekHD\taskhostw.exe
  FirewallRules: [{AA71B4CE-90CE-4BE8-9C51-EF8242F8EAD6}] => (Allow) C:\ProgramData\Windows\rutserv.exe () [File not signed]
  FirewallRules: [{2EC36880-5F44-4D02-9DAD-8D34BB03DBBE}] => (Allow) C:\ProgramData\WindowsTask\AppModule.exe => No File
  FirewallRules: [{C1BEBDD6-E09B-4443-993C-B69C64A8C2EF}] => (Allow) C:\ProgramData\WindowsTask\AMD.exe => No File
  FirewallRules: [{74C6288D-0D88-4D7A-ACF6-A69E9F03402A}] => (Allow) C:\ProgramData\WindowsTask\AppModule.exe => No File
  FirewallRules: [{6C9750BD-7458-440B-9944-79A97C819A74}] => (Allow) C:\ProgramData\WindowsTask\MicrosoftHost.exe (Microsoft Corporation) [File not signed]
  FirewallRules: [{5B520C3F-34ED-4321-B84C-5D0FCD812983}] => (Allow) C:\ProgramData\rundll\rundll.exe
  FirewallRules: [{B3908E64-1B86-4715-89C2-C31826741189}] => (Allow) C:\ProgramData\rundll\Doublepulsar-1.3.1.exe
  FirewallRules: [{1C236B0D-6727-41AA-8511-EC60F1ADD859}] => (Allow) C:\ProgramData\rundll\Eternalblue-2.2.0.exe
  FirewallRules: [{BF63DC49-11E5-4172-BB64-5AC47ABCEFD2}] => (Allow) C:\ProgramData\windows\rutserv.exe () [File not signed]
  FirewallRules: [{3D8C80EA-F5E6-4DCB-BFE9-349AF5BF86EE}] => (Allow) LPort=9393
  FirewallRules: [{CD0EA13A-0D9D-4CC3-BE80-EF15A216A827}] => (Block) LPort=445
  FirewallRules: [{ABFABFBB-8E92-4EDC-A840-61DB59ADA4EE}] => (Allow) C:\ProgramData\WindowsTask\MicrosoftHost.exe (Microsoft Corporation) [File not signed]
  FirewallRules: [{1216D8E8-8ADA-4F28-83BB-42E3B8EE45BD}] => (Allow) LPort=9494
  FirewallRules: [{9072A9D1-02C8-43FA-BEF3-EB521F112CD4}] => (Allow) LPort=9494
  FirewallRules: [{9328B44F-92CE-48EC-B40A-B96DC6738DA9}] => (Block) LPort=139
  FirewallRules: [{7EF8FC2F-3171-40D4-93FE-50E46C16954A}] => (Allow) LPort=9393
  FirewallRules: [{BD9CBD45-B329-443E-907D-C9BDF2EE04B6}] => (Allow) LPort=3389
  FirewallRules: [{3E71B738-B7DD-4D39-B411-1F69320FC525}] => (Allow) C:\ProgramData\rundll\system.exe
  FirewallRules: [{D76EFB7D-BD3B-4D13-BF90-92052967D08B}] => (Block) LPort=139
  FirewallRules: [{1386E66A-6767-4B45-B76B-9069F45AA707}] => (Block) LPort=445
  FirewallRules: [{9BB007C6-A4A0-4DA9-866E-5492B074984D}] => (Allow) C:\ProgramData\WindowsTask\AMD.exe => No File
  FirewallRules: [{08B00720-B559-4432-AF83-CC0ACD05F37A}] => (Allow) C:\ProgramData\RealtekHD\taskhostw.exe (Realtek Semiconductor) [File not signed]
  FirewallRules: [{6CDE0C53-7A4D-463C-9D4F-7F79F5B1101C}] => (Allow) LPort=3389
  ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
  EmptyTemp:
  Reboot:
  End::

• Скопируйте выделенный текст (правой кнопкой - Копировать).
• Запустите FRST (FRST64) от имени администратора.
• Нажмите Fix один раз (!) и подождите. Программа создаст лог-файл (Fixlog.txt). Прикрепите его к своему следующему сообщению.

Компьютер будет перезагружен автоматически.

Подробнее читайте в этом руководстве.