Вылазит постоянно сообщение адрес заблокирован у антивируса

[linar5]

Вылазит постоянно сообщение адрес заблокирован у антивируса

[Info_bot]

Уважаемый(ая) linar5, спасибо за обращение на наш форум!

Помощь в лечении компьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитой Autologger, подробнее можно прочитать в правилах оформления запроса о помощи (https://virusinfo.info/pravila.html).

Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом Помогите+ (https://virusinfo.info/content.php?r=613-sub_pomogite).

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста, поддержите проект (https://virusinfo.info/content.php?r=113-virusinfo.info-donate).

[Vvvyg]

Продолжать будете здесь, или на Кибере? Если здесь, выполните скрипт в AVZ из папки Autologger\AV\av_z.exe в безопасном режиме системы (http://virusinfo.info/showthread.php?t=7239):
begin
QuarantineFile('C:\Program Files (x86)\nodejs\nodeupdate.vbs', '');
QuarantineFile('C:\ProgramData\Google\Chrome\updat er.exe', '');
QuarantineFile('C:\ProgramData\Microsoft\wext.vbs' , '');
DeleteFile('C:\Program Files (x86)\nodejs\nodeupdate.vbs', '64');
DeleteFile('C:\ProgramData\Google\Chrome\updater.e xe', '64');
DeleteFile('C:\ProgramData\Microsoft\wext.vbs', '64');
DeleteFile('C:\Users\PC\AppData\Local\Temp\Rar$EXa 10428.38799\x64\CCleanerBugReport.exe', '32');
DeleteFile('C:\Users\PC\AppData\Roaming\Sandboxie\ sandboxie.exe', '32');
DeleteFile('C:\Users\PC\AppData\Roaming\Sandboxie\ sandboxie.exe', '64');
DeleteService('GoogleUpdateTaskMachineQC');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'GoogleUpdateTaskMachineQC');
DeleteSchedulerTask('C:\Windows\Task\CCleanerCrash Reporting.job');
DeleteSchedulerTask('CCleanerCrashReporting');
DeleteSchedulerTask('CCleanerSkipUAC - PC');
DeleteSchedulerTask('MyNode');
DeleteSchedulerTask('OperaUpdateTask');
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
ExecuteSysClean;
ExecuteWizard('SCU', 2, 2, true);
RebootWindows(false);
end.Компьютер перезагрузится.

В папке с AVZ появится архив карантина quarantine.zip, упакуйте его в архив с паролем, выложите на файлообменник или в облако и дайте ссылку с паролем в личном сообщении.

Скачайте, распакуйте и запустите утилиту ClearLNK (https://virusinfo.info/soft/tool.php?tool=ClearLNK). Скопируйте текст ниже в окно утилиты и нажмите "Лечить".
>>> "C:\Users\1\Desktop\Opera.lnk" -> ["C:\Users\1\AppData\Local\Programs\Opera\launcher.e xe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Repack by Fenixx\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC.lnk" -> ["E:\Games\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\bin\witcher2.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Repack by Fenixx\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\The Witcher 2.Assassins Of Kings.(Лаунчер).lnk" -> ["E:\Games\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\Launcher.exe"]
>>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Star t Menu\Programs\Python 3.10\Python 3.10 (64-bit).lnk" -> ["C:\Users\PC\AppData\Local\Programs\Python\Python31 0\python.exe"]
>>> "C:\Users\Default\AppData\Roaming\Microsoft\Windows \SendTo\Fax Recipient.lnk" -> ["C:\Windows\system32\WFS.exe" =>> /SendTo]
>>> "C:\Users\Default\AppData\Roaming\Microsoft\Windows \Start Menu\Programs\Accessibility\Narrator.lnk" -> ["C:\Windows\system32\narrator.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk" -> ["C:\Windows\system32\SnippingTool.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Repack by Fenixx\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\The Witcher 2.Assassins Of Kings.(Настройки).lnk" -> ["E:\Games\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\bin\Configurator.exe"]
>>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Star t Menu\Programs\Python 3.10\IDLE (Python 3.10 64-bit).lnk" -> ["C:\Users\PC\AppData\Local\Programs\Python\Python31 0\pythonw.exe" =>> "C:\Users\PC\AppData\Local\Programs\Python\Python31 0\Lib\idlelib\idle.pyw"]
>>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Star t Menu\Programs\Python 3.10\Python 3.10 Module Docs (64-bit).lnk" -> ["C:\Users\PC\AppData\Local\Programs\Python\Python31 0\python.exe" =>> -m pydoc -b]
>>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Star t Menu\Programs\Accessibility\Narrator.lnk" -> ["C:\Windows\system32\narrator.exe"]
>>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Star t Menu\Programs\Accessibility\On-Screen Keyboard.lnk" -> ["C:\Windows\system32\osk.exe"]
>>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Send To\Fax Recipient.lnk" -> ["C:\Windows\system32\WFS.exe" =>> /SendTo]
>>> "C:\Users\PC\AppData\Local\Microsoft\Windows\WinX\G roup3\09 - Mobility Center.lnk" -> ["C:\Windows\system32\mblctr.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect 1 L.E\Mass Effect 1 L.E.lnk" -> ["E:\Games\Mass Effect 1 L.E\Game\Launcher\MassEffectLauncher.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Erica\Erica.lnk" -> ["D:\Games\Erica\erica.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect 1 L.E\Uninstall Mass Effect 1 L.E.lnk" -> ["E:\Games\Mass Effect 1 L.E\Uninstall\unins000.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Repack by Fenixx\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\Деинсталлировать The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC.lnk" -> ["E:\Games\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\Uninstall\unins000.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Erica\Uninstall Erica.lnk" -> ["D:\Games\Erica\unins000.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Super Seducer 3.lnk" -> ["D:\Games\SuperSeducer3\SuperSeducer3.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Prince of Persia - The Forgotten Sands\Prince of Persia - The Forgotten Sands.lnk" -> ["D:\Games\Prince of Persia - The Forgotten Sands\Prince of Persia.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Prince of Persia - The Forgotten Sands\Настройки.lnk" -> ["D:\Games\Prince of Persia - The Forgotten Sands\GameSettings.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Prince of Persia - The Forgotten Sands\Деинсталлировать Prince of Persia - The Forgotten Sands.lnk" -> ["D:\Games\Prince of Persia - The Forgotten Sands\unins000.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine tutorial.lnk" -> ["C:\Program Files\Cheat Engine 7.5\Tutorial-i386.exe"]
>>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Star t Menu\Programs\poigraem\Король Покера 2.lnk" -> ["D:\Games\Governor of Poker 2 rus\GovernorofPoker2_PE.exe"]
>>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Star t Menu\Programs\Last Man\Uninstall.lnk" -> ["E:\Downloads\1\Last Man\uninstall.exe"]
>>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Star t Menu\Programs\Last Man\Last Man.lnk" -> ["E:\Downloads\1\Last Man\Last_Man.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Witcher 3 - GOTY\Uninstall The Witcher 3 - GOTY.lnk" -> ["D:\Games\The Witcher 3 - GOTY\Uninstall\unins000.exe"]
>>> "C:\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk" -> ["C:\Windows\system32\osk.exe"]
>>> "C:\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk" -> ["C:\Windows\system32\narrator.exe"]
>>> "C:\Users\1\AppData\Roaming\Microsoft\Windows\SendT o\Fax Recipient.lnk" -> ["C:\Windows\system32\WFS.exe" =>> /SendTo]
>>> "C:\Users\1\AppData\Local\Microsoft\Windows\WinX\Gr oup3\09 - Mobility Center.lnk" -> ["C:\Windows\system32\mblctr.exe"]
>>> "C:\Users\1\Desktop\Bannerlord.lnk" -> ["E:\Games\Mount & Blade II Bannerlord\bin\Win64_Shipping_Client\Bannerlord.ex e"]
>>> "C:\Users\1\Desktop\Civilization VI.lnk" -> ["D:\Games\Sid Meiers Civilization VI\Base\Binaries\Win64Steam\CivilizationVI_DX12.ex e"]
>>> "C:\Users\1\Desktop\Discord.lnk" -> ["C:\Users\1\AppData\Local\Discord\Update.exe" =>> --processStart Discord.exe]
>>> "C:\Users\1\Desktop\GeForce Experience.lnk" -> ["C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe"]
>>> "C:\Users\1\Desktop\Kingdom Rush HD.lnk" -> ["D:\Games\Kingdom Rush HD\Kingdom Rush.exe"]
>>> "C:\Users\1\Desktop\PlagueInc.lnk" -> ["D:\Games\Plague Inc Evolved The Fake News\PlagueIncEvolved.exe"]
>>> "C:\Users\1\Desktop\Telegram.lnk" -> ["C:\Users\1\AppData\Roaming\Telegram Desktop\Telegram.exe"]
>>> "C:\Users\1\Desktop\Tor Browser 11.0.7.lnk" -> ["C:\Tor Browser 11.0.7 portable (TA-2111).exe"]
>>> "C:\Users\1\Desktop\Torchlight III.lnk" -> ["D:\Games\Torchlight III\Frontiers.exe"]
>>> "C:\Users\1\Desktop\Witcher 3.lnk" -> ["E:\Games\The Witcher 3 - Wild Hunt\bin\x64\witcher3.exe"]
>>> "C:\Users\1\Desktop\Adobe Photoshop 2020.lnk" -> ["C:\Program Files\Adobe\Adobe Photoshop 2020\Photoshop.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Star Wars Jedi Fallen Order\Star Wars Jedi Fallen Order.lnk" -> ["E:\Games\Star Wars Jedi Fallen Order\SwGame\Binaries\Win64\starwarsjedifallenorde r.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Star Wars Jedi Fallen Order\Uninstall Star Wars Jedi Fallen Order.lnk" -> ["E:\Games\Star Wars Jedi Fallen Order\Uninstall\unins000.exe"]
>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraCompare\IDM Error Reporting.lnk" -> ["C:\Users\PC\Desktop\IDMMonitor.exe"]Отчёт о работе прикрепите.

Скачайте Farbar Recovery Scan Tool (http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/) или с зеркала (https://www.geekstogo.com/forum/files/file/435-frst-farbar-recovery-scan-tool/) и сохраните на Рабочем столе.

Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.
Запустите программу. Когда программа запустится, нажмите Да для соглашения с предупреждением.

Нажмите кнопку Сканировать.

После окончания сканирования будут созданы отчеты FRST.txt, Addition.txt в той же папке, откуда была запущена программа.
Прикрепите эти файлы к своему следующему сообщению (лучше оба в одном архиве).

[linar5]

Если тут быстрее ответят, то здесь буду продолжать. Я все сделал, в личку отправил. При сканировании он завис, ничего не происходит. Файлы прикрепляю.

[Vvvyg]

Выполняйте также в безопасном режиме, после перезагрузки сделайте новые логи FRST.

Выделите и скопируйте в буфер обмена следующий код:
Start::
CloseProcesses:
HKU\S-1-5-21-2548779362-2516317261-3690425480-1001\...\Run: [MOBA Trainer] => "C:\Users\PC\AppData\Local\Programs\mobatrainer\MOB A Trainer.exe" --hidden (Нет файла)
Task: {EA5287FB-40D9-4C04-A86D-6257FC0F3CF4} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_ex e => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Нет файла)
Task: {3D71D8C9-D0ED-48E5-BABC-950B377D57EB} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Нет файла)
Task: {15A8EF92-94AF-4CB3-B56D-D08D82B8AE06} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyb oardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe (Нет файла)
Task: {F3602846-1CBB-4B1A-AE8F-1CA44A6C37EE} - System32\Tasks\OperaUpdate => C:\Windows\system32\cmd.exe [289792 2022-10-14] (Microsoft Windows -> Microsoft Corporation) -> /c auditpol /set /category:"Система" /success:enable && auditpol /set /category:"Подробное отслеживание" /subcategory:"Создание процесса" /success:enable <==== ВНИМАНИЕ
C:\Users\PC\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\knpaahgfmjnnbcdjmedhfiocja figamo
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbbimhdifknonpfpblipdagoam jaicin
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpfpmnhblodfgegbienkhfjlnj baoaal
C:\Users\PC\AppData\Local\Yandex\YandexBrowser\Use r Data\Default\Extensions\nmbbdkebkicbknnajhdehfecml ocibpb
S3 BITS_bkp; C:\Windows\System32\qmgr.dll [1481216 2022-10-14] (Microsoft Windows -> Microsoft Corporation)
S2 dosvc_bkp; C:\Windows\system32\dosvc.dll [1503232 2022-10-14] (Microsoft Windows -> Microsoft Corporation)
S2 GoogleUpdateTaskMachineQC; C:\ProgramData\Google\Chrome\updater.exe [422352 2025-04-15] (Tonalio GmbH -> Sandboxie-Plus.com) <==== ВНИМАНИЕ
C:\ProgramData\Google\Chrome\updater.exe
S2 UsoSvc_bkp; C:\Windows\system32\usosvc.dll [570368 2022-10-14] (Microsoft Windows -> Microsoft Corporation)
S3 WaaSMedicSvc_bkp; C:\Windows\System32\WaaSMedicSvc.dll [427520 2022-10-14] (Microsoft Windows -> Microsoft Corporation)
S3 wuauserv_bkp; C:\Windows\system32\wuaueng.dll [3406848 2022-10-14] (Microsoft Windows -> Microsoft Corporation)
S2 RServer3; "C:\Windows\SysWOW64\rserver30\RServer3.exe" /service [X]
S3 imdisk; \??\c:\users\pc\appdata\local\temp\jinn\isorun\x64 \imdisk.sys [X] <==== ВНИМАНИЕ
S1 raddrvv3; \??\C:\Windows\SysWOW64\rserver30\raddrvv3.sys [X]
2025-03-22 14:45 - 2025-04-15 23:03 - 000000000 ____D C:\Program Files (x86)\nodejs
2025-03-22 14:45 - 2025-04-15 21:54 - 000034707 _____ C:\Users\PC\ex-list2.json
2025-03-22 14:45 - 2025-04-15 21:54 - 000000391 _____ C:\Users\PC\bs-list.json
2025-03-22 14:45 - 2025-03-22 14:45 - 000000207 _____ C:\Users\PC\e-user.json
2025-03-22 14:45 - 2025-03-22 14:45 - 000000103 _____ C:\Users\PC\e-country.json
2025-04-15 17:43 - 2025-04-15 17:43 - 000000364 _____ () C:\Users\PC\nodejs.dat
Unlock: C:\Users\1\AppData\Roaming\FileZilla
Unlock: C:\Users\1\AppData\Local\FileZilla
CustomCLSID: HKU\S-1-5-21-2548779362-2516317261-3690425480-1001_Classes\CLSID\{5C4D8D77-5B87-40CA-884E-F56858227E5C}\localserver32 -> C:\Users\PC\AppData\Local\Programs\TeamSpeak\notif ication_helper.exe => Нет файла
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => -> Нет файла
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => -> Нет файла
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => -> Нет файла
ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => -> Нет файла
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> Нет файла
ContextMenuHandlers1: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => -> Нет файла
ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> Нет файла
ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} => -> Нет файла
ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => -> Нет файла
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> Нет файла
ContextMenuHandlers6: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => -> Нет файла
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> Нет файла
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\BITS]
"DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
"Description"="@%SystemRoot%\\system32\\qmgr.dll,-1001"
"DisplayName"="@%SystemRoot%\\system32\\qmgr.dll,-1000"
"ErrorControl"=dword:00000001
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00, 00,14,00,00,\
00,01,00,00,00,60,ea,00,00,01,00,00,00,c0,d4,01,00 ,00,00,00,00,00,00,00,00
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00, 52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d ,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00 ,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73 ,00,20,00,2d,00,70,00,00,\
00
"ObjectName"="LocalSystem"
"RequiredPrivileges"=hex(7):53,00,65,00,43,00,72,00,65,00,61,00,74,00, 65,00,47,\
00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,00 ,76,00,69,00,6c,00,65,00,\
67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65 ,00,72,00,73,00,6f,00,6e,\
00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00 ,6c,00,65,00,67,00,65,00,\
00,00,53,00,65,00,54,00,63,00,62,00,50,00,72,00,69 ,00,76,00,69,00,6c,00,65,\
00,67,00,65,00,00,00,53,00,65,00,41,00,73,00,73,00 ,69,00,67,00,6e,00,50,00,\
72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b ,00,65,00,6e,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00 ,53,00,65,00,49,00,6e,00,\
63,00,72,00,65,00,61,00,73,00,65,00,51,00,75,00,6f ,00,74,00,61,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00 ,53,00,65,00,44,00,65,00,\
62,00,75,00,67,00,50,00,72,00,69,00,76,00,69,00,6c ,00,65,00,67,00,65,00,00,\
00,00,00
"ServiceSidType"=dword:00000001
"Start"=dword:00000002
"Type"=dword:00000020
"DelayedAutostart"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\BITS\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00, 52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00 ,6d,00,33,00,32,00,5c,00,\
71,00,6d,00,67,00,72,00,2e,00,64,00,6c,00,6c,00,00 ,00
"ServiceDllUnloadOnStop"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\BITS\Performance]
"Close"="PerfMon_Close"
"Collect"="PerfMon_Collect"
"Library"="C:\\Windows\\System32\\bitsperf.dll"
"Open"="PerfMon_Open"
"InstallType"=dword:00000001
"PerfIniFile"="bitsctrs.ini"
"First Counter"=dword:000021a8
"Last Counter"=dword:000021b8
"First Help"=dword:000021a9
"Last Help"=dword:000021b9
"Object List"="8616"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\BITS\Security]
"Security"=hex:01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00, 00,34,00,00,00,02,\
00,20,00,01,00,00,00,02,c0,18,00,00,00,0c,00,01,02 ,00,00,00,00,00,05,20,00,\
00,00,20,02,00,00,02,00,5c,00,04,00,00,00,00,02,14 ,00,ff,01,0f,00,01,01,00,\
00,00,00,00,05,12,00,00,00,00,00,18,00,ff,01,0f,00 ,01,02,00,00,00,00,00,05,\
20,00,00,00,20,02,00,00,00,00,14,00,8d,01,02,00,01 ,01,00,00,00,00,00,05,04,\
00,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00 ,00,05,06,00,00,00,01,02,\
00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00 ,00,00,00,00,05,20,00,00,\
00,20,02,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\DoSvc]
"DependOnService"=hex(7):72,00,70,00,63,00,73,00,73,00,00,00,00,00
"Description"="@%systemroot%\\system32\\dosvc.dll,-101"
"DisplayName"="@%systemroot%\\system32\\dosvc.dll,-100"
"ErrorControl"=dword:00000001
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00, 00,14,00,00,\
00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00 ,00,00,00,00,00,00,00,00
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00, 52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d ,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00 ,78,00,65,00,20,00,2d,00,\
6b,00,20,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b ,00,53,00,65,00,72,00,76,\
00,69,00,63,00,65,00,20,00,2d,00,70,00,00,00
"LaunchProtected"=dword:00000002
"ObjectName"="NT Authority\\NetworkService"
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00, 52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00 ,6d,00,33,00,32,00,5c,00,\
64,00,6f,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c ,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceSidType"=dword:00000001
"Start"=dword:00000002
"SvcMemHardLimitInMB"=dword:00000027
"SvcMemMidLimitInMB"=dword:0000001b
"SvcMemSoftLimitInMB"=dword:0000000f
"Type"=dword:00000010
"DelayedAutostart"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\DoSvc\Security]
"Security"=hex:01,00,14,80,a0,00,00,00,ac,00,00,00,14,00,00, 00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01 ,00,00,00,00,00,01,00,00,\
00,00,02,00,70,00,04,00,00,00,00,00,14,00,9d,00,02 ,00,01,01,00,00,00,00,00,\
05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00 ,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00 ,00,00,05,12,00,00,00,00,\
00,28,00,22,00,02,00,01,06,00,00,00,00,00,05,50,00 ,00,00,4d,f8,19,b6,b3,a7,\
7f,e3,93,9a,10,ee,20,5d,51,ab,9b,39,b9,82,01,01,00 ,00,00,00,00,05,12,00,00,\
00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\DoSvc\TriggerInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\DoSvc\TriggerInfo\0]
"Action"=dword:00000001
"Data0"=hex:75,10,bc,a3,29,01,c6,41
"DataType0"=dword:00000001
"GUID"=hex:16,28,7a,2d,5e,0c,fc,45,9c,e7,57,0e,5e,cd,e9, c9
"Type"=dword:00000007

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\DoSvc\TriggerInfo\1]
"Action"=dword:00000001
"GUID"=hex:e6,ca,9f,65,db,5b,a9,4d,b1,ff,ca,2a,17,8d,46, e0
"Type"=dword:00000005

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\UsoSvc]
"DelayedAutoStart"=dword:00000001
"DependOnService"=hex(7):72,00,70,00,63,00,73,00,73,00,00,00,00,00
"Description"="@%systemroot%\\system32\\usosvc.dll,-102"
"DisplayName"="@%systemroot%\\system32\\usosvc.dll,-101"
"ErrorControl"=dword:00000001
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00, 00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00 ,00,00,00,00,00,00,00,00
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00, 72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d ,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00 ,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73 ,00,20,00,2d,00,70,00,00,\
00
"ObjectName"="LocalSystem"
"PreshutdownTimeout"=dword:0036ee80
"RequiredPrivileges"=hex(7):53,00,65,00,41,00,75,00,64,00,69,00,74,00, 50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00 ,53,00,65,00,43,00,72,00,\
65,00,61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61 ,00,6c,00,50,00,72,00,69,\
00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00 ,65,00,43,00,72,00,65,00,\
61,00,74,00,65,00,50,00,61,00,67,00,65,00,46,00,69 ,00,6c,00,65,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00 ,53,00,65,00,54,00,63,00,\
62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67 ,00,65,00,00,00,53,00,65,\
00,41,00,73,00,73,00,69,00,67,00,6e,00,50,00,72,00 ,69,00,6d,00,61,00,72,00,\
79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,72,00,69 ,00,76,00,69,00,6c,00,65,\
00,67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00 ,65,00,72,00,73,00,6f,00,\
6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69 ,00,6c,00,65,00,67,00,65,\
00,00,00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00 ,61,00,73,00,65,00,51,00,\
75,00,6f,00,74,00,61,00,50,00,72,00,69,00,76,00,69 ,00,6c,00,65,00,67,00,65,\
00,00,00,53,00,65,00,53,00,68,00,75,00,74,00,64,00 ,6f,00,77,00,6e,00,50,00,\
72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00 ,00,53,00,65,00,44,00,65,\
00,62,00,75,00,67,00,50,00,72,00,69,00,76,00,69,00 ,6c,00,65,00,67,00,65,00,\
00,00,53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70 ,00,50,00,72,00,69,00,76,\
00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00 ,52,00,65,00,73,00,74,00,\
6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c ,00,65,00,67,00,65,00,00,\
00,53,00,65,00,53,00,65,00,63,00,75,00,72,00,69,00 ,74,00,79,00,50,00,72,00,\
69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53 ,00,65,00,54,00,61,00,6b,\
00,65,00,4f,00,77,00,6e,00,65,00,72,00,73,00,68,00 ,69,00,70,00,50,00,72,00,\
69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53 ,00,65,00,4c,00,6f,00,61,\
00,64,00,44,00,72,00,69,00,76,00,65,00,72,00,50,00 ,72,00,69,00,76,00,69,00,\
6c,00,65,00,67,00,65,00,00,00,53,00,65,00,4d,00,61 ,00,6e,00,61,00,67,00,65,\
00,56,00,6f,00,6c,00,75,00,6d,00,65,00,50,00,72,00 ,69,00,76,00,69,00,6c,00,\
65,00,67,00,65,00,00,00,53,00,65,00,53,00,79,00,73 ,00,74,00,65,00,6d,00,45,\
00,6e,00,76,00,69,00,72,00,6f,00,6e,00,6d,00,65,00 ,6e,00,74,00,50,00,72,00,\
69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53 ,00,65,00,43,00,72,00,65,\
00,61,00,74,00,65,00,53,00,79,00,6d,00,62,00,6f,00 ,6c,00,69,00,63,00,4c,00,\
69,00,6e,00,6b,00,50,00,72,00,69,00,76,00,69,00,6c ,00,65,00,67,00,65,00,00,\
00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00 ,73,00,65,00,42,00,61,00,\
73,00,65,00,50,00,72,00,69,00,6f,00,72,00,69,00,74 ,00,79,00,50,00,72,00,69,\
00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
"ServiceSidType"=dword:00000001
"Start"=dword:00000002
"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\UsoSvc\Parameters]
"ServiceDll"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00, 72,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00 ,6d,00,33,00,32,00,5c,00,\
75,00,73,00,6f,00,73,00,76,00,63,00,2e,00,64,00,6c ,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceMain"="ServiceMain"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\UsoSvc\Security]
"Security"=hex:01,00,14,80,78,00,00,00,84,00,00,00,14,00,00, 00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,00,0f,00,01,01 ,00,00,00,00,00,01,00,00,\
00,00,02,00,48,00,03,00,00,00,00,00,14,00,9d,00,02 ,00,01,01,00,00,00,00,00,\
05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00 ,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00 ,00,00,05,12,00,00,00,01,\
01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00 ,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\WaaSMedicSvc]
"DependOnService"=hex(7):72,00,70,00,63,00,73,00,73,00,00,00,00,00
"Description"="@WaaSMedicSvcImpl.dll,-101"
"DisplayName"="@WaaSMedicSvcImpl.dll,-100"
"ErrorControl"=dword:00000001
"FailureActions"=hex:84,03,00,00,00,00,00,00,00,00,00,00,03,00,00, 00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00 ,00,00,00,00,00,00,00,00
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00, 72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d ,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00 ,78,00,65,00,20,00,2d,00,\
6b,00,20,00,77,00,75,00,73,00,76,00,63,00,73,00,20 ,00,2d,00,70,00,00,00
"LaunchProtected"=dword:00000002
"ObjectName"="LocalSystem"
"RequiredPrivileges"=hex(7):53,00,65,00,54,00,63,00,62,00,50,00,72,00, 69,00,76,\
00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00 ,43,00,68,00,61,00,6e,00,\
67,00,65,00,4e,00,6f,00,74,00,69,00,66,00,79,00,50 ,00,72,00,69,00,76,00,69,\
00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00 ,6d,00,70,00,65,00,72,00,\
73,00,6f,00,6e,00,61,00,74,00,65,00,50,00,72,00,69 ,00,76,00,69,00,6c,00,65,\
00,67,00,65,00,00,00,53,00,65,00,54,00,61,00,6b,00 ,65,00,4f,00,77,00,6e,00,\
65,00,72,00,73,00,68,00,69,00,70,00,50,00,72,00,69 ,00,76,00,69,00,6c,00,65,\
00,67,00,65,00,00,00,53,00,65,00,53,00,65,00,63,00 ,75,00,72,00,69,00,74,00,\
79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67 ,00,65,00,00,00,53,00,65,\
00,42,00,61,00,63,00,6b,00,75,00,70,00,50,00,72,00 ,69,00,76,00,69,00,6c,00,\
65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73 ,00,74,00,6f,00,72,00,65,\
00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00 ,65,00,00,00,53,00,65,00,\
4d,00,61,00,6e,00,61,00,67,00,65,00,56,00,6f,00,6c ,00,75,00,6d,00,65,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00 ,00,00,00,00
"ServiceSidType"=dword:00000001
"Start"=dword:00000003
"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\WaaSMedicSvc\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00, 52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00 ,6d,00,33,00,32,00,5c,00,\
57,00,61,00,61,00,53,00,4d,00,65,00,64,00,69,00,63 ,00,53,00,76,00,63,00,2e,\
00,64,00,6c,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceMain"="ServiceMain"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\WaaSMedicSvc\Security]
"Security"=hex:01,00,14,80,78,00,00,00,84,00,00,00,14,00,00, 00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,00,0f,00,01,01 ,00,00,00,00,00,01,00,00,\
00,00,02,00,48,00,03,00,00,00,00,00,14,00,9d,00,02 ,00,01,01,00,00,00,00,00,\
05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00 ,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00 ,00,00,05,12,00,00,00,01,\
01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00 ,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\wuauserv]
"DependOnService"=hex(7):72,00,70,00,63,00,73,00,73,00,00,00,00,00
"Description"="@%systemroot%\\system32\\wuaueng.dll,-106"
"DisplayName"="@%systemroot%\\system32\\wuaueng.dll,-105"
"ErrorControl"=dword:00000001
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00, 00,14,00,00,\
00,01,00,00,00,60,ea,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00, 72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d ,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00 ,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73 ,00,20,00,2d,00,70,00,00,\
00
"ObjectName"="LocalSystem"
"RequiredPrivileges"=hex(7):53,00,65,00,41,00,75,00,64,00,69,00,74,00, 50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00 ,53,00,65,00,43,00,72,00,\
65,00,61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61 ,00,6c,00,50,00,72,00,69,\
00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00 ,65,00,43,00,72,00,65,00,\
61,00,74,00,65,00,50,00,61,00,67,00,65,00,46,00,69 ,00,6c,00,65,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00 ,53,00,65,00,54,00,63,00,\
62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67 ,00,65,00,00,00,53,00,65,\
00,41,00,73,00,73,00,69,00,67,00,6e,00,50,00,72,00 ,69,00,6d,00,61,00,72,00,\
79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,72,00,69 ,00,76,00,69,00,6c,00,65,\
00,67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00 ,65,00,72,00,73,00,6f,00,\
6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69 ,00,6c,00,65,00,67,00,65,\
00,00,00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00 ,61,00,73,00,65,00,51,00,\
75,00,6f,00,74,00,61,00,50,00,72,00,69,00,76,00,69 ,00,6c,00,65,00,67,00,65,\
00,00,00,53,00,65,00,53,00,68,00,75,00,74,00,64,00 ,6f,00,77,00,6e,00,50,00,\
72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00 ,00,53,00,65,00,44,00,65,\
00,62,00,75,00,67,00,50,00,72,00,69,00,76,00,69,00 ,6c,00,65,00,67,00,65,00,\
00,00,53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70 ,00,50,00,72,00,69,00,76,\
00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00 ,52,00,65,00,73,00,74,00,\
6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c ,00,65,00,67,00,65,00,00,\
00,53,00,65,00,53,00,65,00,63,00,75,00,72,00,69,00 ,74,00,79,00,50,00,72,00,\
69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53 ,00,65,00,54,00,61,00,6b,\
00,65,00,4f,00,77,00,6e,00,65,00,72,00,73,00,68,00 ,69,00,70,00,50,00,72,00,\
69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53 ,00,65,00,4c,00,6f,00,61,\
00,64,00,44,00,72,00,69,00,76,00,65,00,72,00,50,00 ,72,00,69,00,76,00,69,00,\
6c,00,65,00,67,00,65,00,00,00,53,00,65,00,4d,00,61 ,00,6e,00,61,00,67,00,65,\
00,56,00,6f,00,6c,00,75,00,6d,00,65,00,50,00,72,00 ,69,00,76,00,69,00,6c,00,\
65,00,67,00,65,00,00,00,53,00,65,00,53,00,79,00,73 ,00,74,00,65,00,6d,00,45,\
00,6e,00,76,00,69,00,72,00,6f,00,6e,00,6d,00,65,00 ,6e,00,74,00,50,00,72,00,\
69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53 ,00,65,00,43,00,72,00,65,\
00,61,00,74,00,65,00,53,00,79,00,6d,00,62,00,6f,00 ,6c,00,69,00,63,00,4c,00,\
69,00,6e,00,6b,00,50,00,72,00,69,00,76,00,69,00,6c ,00,65,00,67,00,65,00,00,\
00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00 ,73,00,65,00,42,00,61,00,\
73,00,65,00,50,00,72,00,69,00,6f,00,72,00,69,00,74 ,00,79,00,50,00,72,00,69,\
00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
"ServiceSidType"=dword:00000001
"Start"=dword:00000003
"SvcMemHardLimitInMB"=dword:000000f6
"SvcMemMidLimitInMB"=dword:000000a7
"SvcMemSoftLimitInMB"=dword:00000058
"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\wuauserv\Parameters]
"ServiceDll"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00, 72,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00 ,6d,00,33,00,32,00,5c,00,\
77,00,75,00,61,00,75,00,65,00,6e,00,67,00,2e,00,64 ,00,6c,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceMain"="WUServiceMain"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\wuauserv\Security]
"Security"=hex:01,00,14,80,78,00,00,00,84,00,00,00,14,00,00, 00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,00,0f,00,01,01 ,00,00,00,00,00,01,00,00,\
00,00,02,00,48,00,03,00,00,00,00,00,14,00,9d,00,02 ,00,01,01,00,00,00,00,00,\
05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00 ,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00 ,00,00,05,12,00,00,00,01,\
01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00 ,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\wuauserv\TriggerInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\wuauserv\TriggerInfo\0]
"Type"=dword:00000005
"Action"=dword:00000001
"Guid"=hex:e6,ca,9f,65,db,5b,a9,4d,b1,ff,ca,2a,17,8d,46, e0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic es\wuauserv\TriggerInfo\1]
"Type"=dword:00000005
"Action"=dword:00000001
"Guid"=hex:c8,46,fb,54,89,f0,4c,46,b1,fd,59,d1,b6,2c,3b, 50
EndRegedit:
Reboot:
End::Запустите FRST.EXE/FRST64.EXE, нажмите один раз Исправить и подождите. Программа создаст лог-файл (Fixlog.txt). Прикрепите его к своему следующему сообщению.
Компьютер будет перезагружен.

[linar5]

Я не понял из сообщения куда код вставлять и поэтому вставил в frst64.exe в поиск и нажал исправить. В следующих сообщениях, пожалуйста, пишите куда вставлять код.

[Vvvyg]

Никуда вставлять не надо. он берёт из буфера обмена. И дважды делаь исправление не стоило, результат первого затёрся. Но всё сработало, как и задумано, в итоге, проблема должна быть решена.

Деинсталлируйте Bonjour, устанавливается допом к другим программам, не нужен. И Adobe Flash Player 32 PPAPI - устарел и не используется.

Обновите WinRar: Российские хакеры используют недавнюю уязвимость в WinRAR (https://www.anti-malware.ru/news/2023-10-16-111332/42116).
Уязвимость в архиваторе WinRAR позволяет обойти метку Mark-of-the-Web (https://www.bleepingcomputer.com/news/security/winrar-flaw-bypasses-windows-mark-of-the-web-security-alerts/).

Переименуйте FRST.exe (или FRST64.exe) в uninstall.exe и запустите. Логи, карантин и другие файлы, созданные программой, будут удалены.
Компьютер перезагрузится.

[linar5]

спс, все работает