Словил тройан, украли данные.

Вложений: 1

Здравствуйте. Попался на фишинг. Запустил тройан у себя на компьютере, после чего злоумышленник связался со мной показал все мои пароли, данные и требовал деньги за удаление данных.
Скачал dr.web сделал проверку. удалил updater.exe на автозапуске.
Но мне кажется что-то наверняка еще осталось. До отправки этих логов вам, я сделал лечение через avz, он писал что некоторые системные dll были модифицированы.
ссылка на вирустотал с троянским exe: [url]https://www.virustotal.com/gui/file/ffcc6eee54fbe169ce3facc218f1a7fd8089223c5b9110da786035d0dd982772[/url]
Могу прикрепить его если нужно.

Уважаемый(ая) [B]POWerrrr[/B], спасибо за обращение на наш форум!

Помощь при заражении компьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы, в самое ближайшее время, ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитой Autologger, подробнее можно прочитать в [URL="https://virusinfo.info/pravila.html"]правилах оформления запроса о помощи[/URL].

[INFORMATION]Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом [URL="https://virusinfo.info/content.php?r=613-sub_pomogite"]Помогите+[/URL].[/INFORMATION]

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста, [URL="https://virusinfo.info/content.php?r=113-virusinfo.info-donate"]поддержите проект[/URL].

Запустите HijackThis, расположенный в папке Autologger и [url="http://virusinfo.info/showthread.php?t=4491"]пофиксите только эти строки[/url]:[code]O4 - HKCU\..\StartupApproved\Run: [Download Master] = C:\Program Files (x86)\Download Master\dmaster.exe -autorun (file missing) (2022/04/16)
O4 - HKLM\..\StartupApproved\Run: [WsDisplaySettings] = C:\WINDOWS\wsdstray.exe (file missing) (2022/03/12)
O8 - Context menu item: HKCU\..\Internet Explorer\MenuExt\Закачать ВСЕ при помощи Download Master: (default) = (no file)
O8 - Context menu item: HKCU\..\Internet Explorer\MenuExt\Закачать при помощи Download Master: (default) = (no file)
O8 - Context menu item: HKCU\..\Internet Explorer\MenuExt\Передать на удаленную закачку DM: (default) = (no file)
O22 - Tasks: Notification Center - C:\ProgramData\Notification Center\service.notification.updater.exe (file missing)
O22 - Tasks: WindowsTaskCoreUpdate - C:\Windows\system32\config\systemprofile\AppData\Roaming\6C60B984D25A433289880F779283BEA9\B206016963EE452D9586FFA37D3CEB9F.vbe (file missing)
O22 - Tasks_Migrated: Sapphire TRIXX - C:\Program Files (x86)\Sapphire TRIXX\TRIXX.exe -s (file missing)
O22 - Tasks_Migrated: SIV - C:\Program Files (x86)\GIGABYTE\SIV\thermald.exe (file missing)
O22 - Tasks_Migrated: SIV-VGA - C:\Program Files (x86)\GIGABYTE\SIV\sensord.exe (file missing)[/code]
Скачайте [URL="http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/"]Farbar Recovery Scan Tool[/URL] или с [URL="https://www.geekstogo.com/forum/files/file/435-frst-farbar-recovery-scan-tool/"]зеркала[/URL] и сохраните на Рабочем столе.

Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.
Запустите программу. Когда программа запустится, нажмите [B]Да[/B] для соглашения с предупреждением.

Нажмите кнопку [B]Сканировать[/B].

После окончания сканирования будут созданы отчеты FRST.txt, Addition.txt в той же папке, откуда была запущена программа.
Прикрепите эти файлы к своему следующему сообщению (лучше оба в одном архиве).

Вложений: 1

Вот, пожалуйста.
1,2,5, строчки не было на фикс.

Выделите и скопируйте в буфер обмена следующий код:[CODE]Start::
CreateRestorePoint:
Task: {6BE1F133-48AD-4312-B561-4C44B0B22073} - System32\Tasks\WindowsTaskCoreUpdate => C:\Windows\system32\config\systemprofile\AppData\Roaming\6C60B984D25A433289880F779283BEA9\B206016963EE452D9586FFA37D3CEB9F.vbe (Нет файла) <==== ВНИМАНИЕ
Task: {97D21FAA-5402-4CC8-A64B-D3DA4E65A5DB} - System32\Tasks\Sapphire TRIXX => C:\Program Files (x86)\Sapphire TRIXX\TRIXX.exe -s (Нет файла)
CHR HKU\S-1-5-21-2273720395-2548854081-4190774751-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ldgpjdiadomhinpimgchmeembbgojnjk]
HKU\S-1-5-21-2273720395-2548854081-4190774751-1000\...\StartupApproved\Run: => "Download Master"
FirewallRules: [{6D89E986-C336-4B13-A21B-2DAA11BF4209}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{94220A9E-A396-46F1-8D13-2BB08BE8B99D}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{58EFBA4E-D8D0-42CD-928B-9BB8AA949688}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{DDB13D06-1A9A-4528-9BD2-14BE50429C6A}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{A6E1385D-4F26-4B24-ABB0-E00334CC03D3}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{03FB6673-16A9-4279-B25E-AFCA11CC0772}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{84251D60-D78A-4725-BEF9-7A236A88D9FF}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{820657AE-9555-43C3-9ED7-491B5F5CAB1E}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{C523DEFC-C844-4311-B3C6-25A8D995A0A1}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{CE8EEDE7-4FE3-44DD-A075-1D6081775AE3}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{9A77EFA2-155D-40E4-B1CD-ECE4E63349BE}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{077C12E6-E1C0-45C3-A11C-FBA53648C177}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{137F909D-776A-4354-A7C2-8AE6E5ED6858}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{7EBFFFDD-5C4D-4C62-91BC-6A11313369C7}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{8E339CE2-A96E-46EF-B24F-75DC82696D7F}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{746BA8D6-D656-45E5-8DEA-B82F4B01C75A}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{A4D90DDD-724C-419A-AB66-7196E5A89407}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{0602CD48-0C3B-4A8E-A212-885D1C42A65F}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{93235856-6587-4343-BBFD-1FC04305843B}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{E424E61B-800C-4F8D-991D-A68F4B2B6F39}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{8A9C978E-AA2D-45DE-AFCC-5B5EF3F45E50}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{00D25324-FD06-41DA-B997-187346161172}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{5BF16C7B-CC7F-4D27-8317-44F3CD7DA355}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{F846D1E7-E54E-44A6-960E-24A329208CB7}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{4EF699CF-114E-4F1F-B226-721F9190D0D5}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{C1EE3F27-B87F-453A-AC24-324FD0F33499}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{3B0ADD79-A666-49DC-AC47-6BDCEBE75E6F}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{4D644170-2A0A-412B-B3E0-F6600993D6D3}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{1A515C03-C59F-43D7-B5B3-3C99D9C9F850}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{EBFB5EEB-CD9C-48ED-8DBB-EADB7C6F1EE4}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{74A1FCBC-1421-414B-BD93-9B19A574DAFD}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{7E217A6C-72DA-4129-AF2A-6C408A490937}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{F29C51A4-FEEE-48A3-84C8-50B716C8EFAC}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{FB8267F8-5A54-4872-A214-98C3B8DA9C77}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{410B275F-0187-4789-86E5-99E25939DC4A}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{549E5576-1C9C-4432-B8D1-8949307812D4}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{D1EF28BA-2647-4E9E-881A-2555DC5EE748}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{48B05B7E-F32F-4EBC-9091-1DEF3B3FA0DD}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{1DE54469-CC48-491A-9A57-D24B854BD662}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{65FDFEAD-C1F5-47CE-AE0B-EBC544A47045}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{D83F3066-37AC-477C-9592-D622049DE807}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{6517B757-E475-4D3C-A0E4-B49E3864DD3C}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{DB70B87A-A316-4237-9A7F-CEE5C7B89C5A}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{138CE52F-4AAB-407E-95E7-195CDD92AFD0}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{8B18F77E-7C97-4F8B-A0C9-1827CE4101DA}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{BB9F8320-C61D-4C47-B052-273F5167F3BF}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{FD0BCC09-ED17-4413-BCD1-3BCE18B6BE40}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{BF4F927A-D918-4B39-933A-9D5E8BA7EF69}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{21E2C3DF-7263-41F1-B994-4CD0CEBF6E5C}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{68F920DA-20E3-4C10-80C2-0B75DFAEEB18}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{E027DB83-E058-47F0-B828-F8742DE23C58}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{87E49E96-9491-4744-AE86-7C21C0B8AAD8}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{D8CB70C4-3F30-413F-A832-0AC9A52D169C}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{BCD80B46-D990-4AE6-B3E4-B511C730B408}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{005E4FD6-A57C-4C4A-BBDD-23A20E500CF9}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{48AC761E-D77B-40E1-89EC-C195E4DD2C84}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{365F39A8-0999-4302-BE96-494EAC013504}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{829E8984-3165-4575-8D07-69D7D9418270}] => (Allow) C:\Windows\System32\WScript.exe
FirewallRules: [{5BF3A71D-73A8-405B-BC0F-DFE17EF2D547}] => (Allow) C:\Windows\SysWOW64\wscript.exe
FirewallRules: [{8DC4B99B-97BC-471C-8EE9-C74920A1D8D3}] => (Allow) C:\Windows\SysWOW64\wscript.exe
FirewallRules: [{8722A07E-4007-4AE8-8823-6429592F8CCF}] => (Allow) LPort=9009
FirewallRules: [{C73C6E89-6408-4D40-B647-DEE5A407B3B6}] => (Allow) LPort=9009
FirewallRules: [{DBB6C17F-6D8F-45E6-8879-416C51FB0F8E}] => (Allow) LPort=9009
FirewallRules: [{3DB91DC8-8F82-46DC-AD18-136B19C76DCC}] => (Allow) LPort=9009
FirewallRules: [{30AE8596-E057-4E2F-90FD-BD39BCFD6010}] => (Allow) LPort=9009
FirewallRules: [{0D77510A-18B6-4B91-862B-4D09F05300AC}] => (Allow) LPort=9009
FirewallRules: [{8EDFB306-D3CB-4A03-86C8-DC5AE512C286}] => (Allow) LPort=9009
FirewallRules: [{33B74640-8093-4971-8EDF-FEB06C74F007}] => (Allow) LPort=9009
FirewallRules: [{33D634C2-53BC-49B0-BDC1-B0EA90EB5CB2}] => (Allow) LPort=9009
FirewallRules: [{7988F809-8E2A-4E62-97C9-6628E3083687}] => (Allow) LPort=9009
FirewallRules: [{F3C61E26-992B-452C-90F3-F55F70E575E3}] => (Allow) LPort=9009
FirewallRules: [{AECF73FB-B883-4B11-814D-C0CAFF26995C}] => (Allow) LPort=9009
FirewallRules: [{7C24F09D-83AF-4E0E-A528-6DEBC396E953}] => (Allow) LPort=9009
FirewallRules: [{EDE28113-49A6-451E-9047-01B476938E71}] => (Allow) LPort=9009
FirewallRules: [{37116C7B-50A0-457C-8234-68DF35A09876}] => (Allow) LPort=9009
FirewallRules: [{22C60A8A-0C9C-46B6-9097-DDDA64E9A53F}] => (Allow) LPort=9009
FirewallRules: [{B3556EC5-8492-4F39-93CC-80FD9CFDEDBF}] => (Allow) LPort=9009
FirewallRules: [{C690DDBC-F77E-4A72-AD33-1FB7307A8B3D}] => (Allow) LPort=9009
FirewallRules: [{B88A7728-5E24-4A76-AE8E-66AEA803ADB2}] => (Allow) LPort=9009
FirewallRules: [{4D3CFA9C-A435-4AF7-924A-6D10989112E5}] => (Allow) LPort=9009
FirewallRules: [{7CE33683-70B9-49D4-9AE7-1D112991842B}] => (Allow) LPort=9009
FirewallRules: [{01106A20-5935-4DB5-AB3B-35CD155F01D8}] => (Allow) LPort=9009
FirewallRules: [{949BA73A-5197-48AC-8F90-DD108C7AF868}] => (Allow) LPort=9009
FirewallRules: [{5B1883EF-4B46-4067-9538-14320B517158}] => (Allow) LPort=9009
FirewallRules: [{13AB220B-3740-4C29-9CC7-683559E6975B}] => (Allow) LPort=9009
FirewallRules: [{53AA655F-BC5C-4119-B6DB-47DE45817416}] => (Allow) LPort=9009
FirewallRules: [{F702079E-83E7-43E8-9A46-8187C150C1A3}] => (Allow) LPort=9009
FirewallRules: [{5D211763-2C7E-4772-A605-4F6EC1CE5DC8}] => (Allow) LPort=9009
FirewallRules: [{1F3D54CC-E14C-45DA-B85F-8386DD1FBA56}] => (Allow) LPort=9009
FirewallRules: [{2DB6F41A-CA56-4F25-9B7E-45C9CD8B612F}] => (Allow) LPort=9009
FirewallRules: [{70432BDB-79FF-4573-B62A-0D0B2043ECDB}] => (Allow) LPort=9009
FirewallRules: [{4FE5B84D-3BD5-45D2-BBF4-30795729E49C}] => (Allow) LPort=9009
FirewallRules: [{05523BF3-F0EC-4D41-A349-E8D3735DDAA5}] => (Allow) LPort=9009
FirewallRules: [{5700D508-B15C-4686-B4C2-B4158C710DFE}] => (Allow) LPort=9009
FirewallRules: [{6C1CDF6E-3BC9-42BF-8CDB-8B86EF2123AB}] => (Allow) LPort=9009
FirewallRules: [{0A3BE8FA-6947-456D-AF8A-0A1A33310E95}] => (Allow) LPort=9009
FirewallRules: [{056B4543-EF85-4EDF-A0E2-D1FA1CC9ACD7}] => (Allow) LPort=9009
FirewallRules: [{77792B8E-8FDC-4988-99F9-8182A62DF192}] => (Allow) LPort=9009
FirewallRules: [{A2D8C1D9-A3AB-445C-BD7F-F33C38EDE965}] => (Allow) LPort=9009
FirewallRules: [{E725E2B0-2873-4C65-A0F2-5BBB1262C7AB}] => (Allow) LPort=9009
FirewallRules: [{F4BC5610-2917-4A0F-A7B9-F25E3E538582}] => (Allow) LPort=9009
FirewallRules: [{50FF75C6-2181-4F68-8B75-92AB0F1261A5}] => (Allow) LPort=9009
FirewallRules: [{F75F47CA-CA03-4CE7-BBFA-8979E60967FC}] => (Allow) LPort=9009
FirewallRules: [{4A8F11D0-C8E7-43FB-84C6-8D88DA5F278D}] => (Allow) LPort=9009
FirewallRules: [{106A4D62-7587-4D55-ACE1-16D138C9E5DE}] => (Allow) LPort=9009
FirewallRules: [{9B9F07D1-BA75-432F-BC54-4835F8A6DCFA}] => (Allow) LPort=9009
FirewallRules: [{FC6AF044-0C0B-4244-8E08-79B652B11867}] => (Allow) LPort=9009
FirewallRules: [{BE2C0D85-B677-4077-BA0C-C36DFF8AB84C}] => (Allow) LPort=9009
FirewallRules: [{C6568DCD-70C8-4CE9-9405-3B901E728DF2}] => (Allow) LPort=9009
FirewallRules: [{8DC43668-A9ED-4E9B-BF7D-AC2CE56CF1D5}] => (Allow) LPort=9009
FirewallRules: [{56D96985-0854-4F79-BD49-11F1FD453ADA}] => (Allow) LPort=9009
FirewallRules: [{17AB3489-70A1-429C-8756-11B90AF7AA42}] => (Allow) LPort=9009
FirewallRules: [{74B6665E-73C2-496F-B315-41F0CC557F91}] => (Allow) LPort=9009
FirewallRules: [{5DADB8F0-B915-4EC3-A21F-B990E82F5D10}] => (Allow) LPort=9009
FirewallRules: [{60253A5C-7D69-4465-8D2C-CBCAC52D66D1}] => (Allow) LPort=9009
FirewallRules: [{08FEBBC6-E968-4223-96AB-362FCB339699}] => (Allow) LPort=9009
FirewallRules: [{98FE85A6-6F00-4D47-B739-F3537DFA255D}] => (Allow) LPort=9009
FirewallRules: [{A5057DAE-1E80-4CA0-8D88-6716C5A13A0C}] => (Allow) LPort=9009
FirewallRules: [{BFF0C4A1-AF94-404D-97A4-CC3965F30321}] => (Allow) LPort=9009
FirewallRules: [{0163F2CB-C57B-4F2A-ACED-2691342CB65B}] => (Allow) LPort=9009
FirewallRules: [{29517BD5-109D-458A-B168-298FA286AC6B}] => (Allow) LPort=9009
FirewallRules: [{8002A56A-FF2B-465E-AD36-8320CC56590D}] => (Allow) LPort=9009
FirewallRules: [{926B14E3-7048-484D-A6EE-93424CEFB865}] => (Allow) LPort=9009
FirewallRules: [{864F5F08-D443-4E40-9863-1175E1817AEA}] => (Allow) LPort=9009
FirewallRules: [{0DA8BD3D-8342-42F4-87F1-3CA8A851848B}] => (Allow) LPort=9009
FirewallRules: [{7FE7EE68-B223-4EDF-846D-4D4C35E4B134}] => (Allow) LPort=9009
FirewallRules: [{DB6DE5A1-1DDE-4E5C-9529-B9E3CFB6CB40}] => (Allow) LPort=9009
FirewallRules: [{CF2054AF-014E-4809-8B4A-B5F9108E41CA}] => (Allow) LPort=9009
FirewallRules: [{01A44702-0E43-42EB-B52F-33120A056B2A}] => (Allow) LPort=9009
FirewallRules: [{CD229A36-1F34-49D5-8743-D43941ADBE29}] => (Allow) LPort=9009
FirewallRules: [{6D4CE885-38E3-49E8-8279-AB9C6B9FC9F8}] => (Allow) LPort=9009
FirewallRules: [{18B05B71-9F8B-4B9D-AEA0-D753226EC554}] => (Allow) LPort=9009
FirewallRules: [{3AE37A8E-218E-46DB-828A-4F0A5313D3B4}] => (Allow) LPort=9009
FirewallRules: [{FC9FBEE2-90A3-477F-8050-839CB9524B2D}] => (Allow) LPort=9009
FirewallRules: [{D5D074D4-A713-4263-846F-9A633AA4BDE3}] => (Allow) LPort=9009
FirewallRules: [{B0CA1A1B-3ABF-4321-ACB0-63F90ED63B97}] => (Allow) LPort=9009
FirewallRules: [{79DC9D01-E35C-4CE1-ACEB-B4DA1C396C4E}] => (Allow) LPort=9009
FirewallRules: [{BE02EA6A-FC35-473A-B152-B2E8CD48AA25}] => (Allow) LPort=9009
FirewallRules: [{F7BAE740-AF5A-46C7-8CFE-84F6AB222456}] => (Allow) LPort=9009
FirewallRules: [{1EB85E29-6A48-49F7-B3CE-A26ECD53BB38}] => (Allow) LPort=9009
FirewallRules: [{C88DF694-34D4-4F9F-8BEC-0CC9B0028826}] => (Allow) LPort=9009
FirewallRules: [{80E3A513-5EAC-4B55-9AC1-B640AAD57BA1}] => (Allow) LPort=9009
FirewallRules: [{7EEC2BF0-4FDE-4972-A241-DC47160C4E22}] => (Allow) LPort=9009
FirewallRules: [{BF684085-202E-444A-88FA-D9494F9170D1}] => (Allow) LPort=9009
FirewallRules: [{B72E062D-9EB1-4EF4-B85D-603E584E401B}] => (Allow) LPort=9009
FirewallRules: [{788757F0-9194-4FB9-A7FD-DFE4903CEC0A}] => (Allow) LPort=9009
FirewallRules: [{8B3C5568-AC84-40AD-8971-7BD1B645F414}] => (Allow) LPort=9009
FirewallRules: [{4A0FA281-103D-47FD-B4A4-EE660A6E3AD8}] => (Allow) LPort=9009
FirewallRules: [{DAC8A019-CD9C-4C88-9671-C8B247CDD393}] => (Allow) LPort=9009
FirewallRules: [{14D42F70-F88C-4BA2-9BBA-0CC480FD627A}] => (Allow) LPort=9009
FirewallRules: [{8CEEAED3-DB1C-47F2-A227-F39A76DCB729}] => (Allow) LPort=9009
FirewallRules: [{54B0698D-38D2-484E-896C-50ABDC2E5F11}] => (Allow) LPort=9009
FirewallRules: [{69718225-269B-4EA8-BD15-D973DF70F88B}] => (Allow) LPort=9009
FirewallRules: [{E2D497D0-C7FD-4446-A398-FC8C6577A252}] => (Allow) LPort=9009
FirewallRules: [{B4DD5547-E529-4D64-AAAF-673F596DF2B6}] => (Allow) LPort=9009
FirewallRules: [{54142A5E-B175-4A59-9A1D-1970CF410245}] => (Allow) LPort=9009
FirewallRules: [{3B728940-A88A-4EFF-B38C-F66A1D264442}] => (Allow) LPort=9009
FirewallRules: [{D1554FCA-8EC9-40FA-A3BE-2249E35F1546}] => (Allow) LPort=9009
FirewallRules: [{7B64AD26-8903-4018-82F7-AF78BB9971A2}] => (Allow) LPort=9009
FirewallRules: [{DA8B1458-A1C4-4838-830A-E94623C61AD6}] => (Allow) LPort=9009
FirewallRules: [{1F14F64A-EE04-440A-830C-EECB79B396F3}] => (Allow) LPort=9009
FirewallRules: [{9A1F6C35-ED45-4C0F-86B6-9FD48464E190}] => (Allow) LPort=9009
FirewallRules: [{1E578F3B-5E6E-4DF1-A702-42FEA217AFD0}] => (Allow) LPort=9009
FirewallRules: [{79EC7481-BDA0-453C-B627-49724D93D584}] => (Allow) LPort=9009
FirewallRules: [{202A6C1E-307D-4E03-87DC-45658B719A5D}] => (Allow) LPort=9009
FirewallRules: [{60CE732B-3572-45EC-B2A8-C30F5C874DEC}] => (Allow) LPort=9009
FirewallRules: [{72A8F9E8-BCCA-41C1-81BF-011738DA2BDF}] => (Allow) LPort=9009
FirewallRules: [{85EF0D1D-9756-42A6-BD7C-EE89733FAE3B}] => (Allow) LPort=9009
FirewallRules: [{2C6F03D6-4C7B-4490-A2EF-31BCBD937D14}] => (Allow) LPort=9009
FirewallRules: [{E6109EC0-4BE3-406B-94CA-61EAC1EE702D}] => (Allow) LPort=9009
FirewallRules: [{2CB0611E-2658-4EF0-A902-0F82B13D1C48}] => (Allow) LPort=9009
FirewallRules: [{1E75D7C3-AB87-4179-B46A-7BC0AC3D23DA}] => (Allow) LPort=9009
FirewallRules: [{DA9E503F-9C92-4C71-B298-60F7F38F37BF}] => (Allow) LPort=9009
FirewallRules: [{80DD4792-130F-4C84-A4A6-766926656040}] => (Allow) LPort=9009
FirewallRules: [{B3C10002-3B84-4144-9ED9-A3B304E763B6}] => (Allow) LPort=9009
FirewallRules: [{AB7FD117-52C0-4154-972E-882DEA8CBED2}] => (Allow) LPort=9009
FirewallRules: [{28039B28-10D9-4A60-BB43-7A68BF75C9F7}] => (Allow) LPort=9009
FirewallRules: [{FEC942A2-244F-4374-8E0E-CFFC60BFB8FD}] => (Allow) LPort=9009
FirewallRules: [{A0B3B49C-1FD2-4666-99FB-3AFB49D0F971}] => (Allow) LPort=9009
FirewallRules: [{174F2FDB-F0DC-48DC-B0DF-5052A7AF948D}] => (Allow) LPort=9009
FirewallRules: [{C9CDBC9F-42D8-413C-B203-72385F39366B}] => (Allow) LPort=9009
FirewallRules: [{8937F501-F70A-43FD-91F3-FDA8DC1DE2DC}] => (Allow) LPort=9009
FirewallRules: [{2FB03319-12F8-4E1C-A203-7DACA975EA2F}] => (Allow) LPort=9009
FirewallRules: [{0BEBA0A6-84C2-4677-AFCA-88AAD04A4E94}] => (Allow) LPort=9009
FirewallRules: [{233D7D95-2775-4D5A-9046-133B22E8327F}] => (Allow) LPort=9009
FirewallRules: [{8327948E-E168-4311-8922-F989DABF67F2}] => (Allow) LPort=9009
FirewallRules: [{7046BFDF-1698-4902-8F08-CE14A8F66AF0}] => (Allow) LPort=9009
FirewallRules: [{CAF8C956-CFC3-47F9-9358-CACFC2345808}] => (Allow) LPort=9009
FirewallRules: [{87140836-220E-444F-8F38-FA9B30BDDB9A}] => (Allow) LPort=9009
FirewallRules: [{5ACCDE38-2018-4B11-891D-41462A0F7D79}] => (Allow) LPort=9009
FirewallRules: [{F5CD10C5-0E7F-437D-99B3-D5126C32112F}] => (Allow) LPort=9009
FirewallRules: [{98C3130E-AA25-42B9-8A1D-95F19ADEF9A8}] => (Allow) LPort=9009
FirewallRules: [{4E067B8C-0E4A-4380-B19F-2CAC17138510}] => (Allow) LPort=9009
FirewallRules: [{B23E1DD0-F6F4-4402-81E7-86480478C66E}] => (Allow) LPort=9009
FirewallRules: [{22F2E295-5ED5-4770-AFF8-C33521F3E396}] => (Allow) LPort=9009
FirewallRules: [{CC2F86AB-26D7-402B-9B0C-709D1901EEB9}] => (Allow) LPort=9009
FirewallRules: [{C3082FEE-4C3F-4D9F-A560-07F3140C317A}] => (Allow) LPort=9009
FirewallRules: [{9FE1E704-E58F-4DB0-A2B2-1EAAA71EBBFA}] => (Allow) LPort=9009
FirewallRules: [{CB04A0C7-ACFA-4661-9A28-B250F97D692D}] => (Allow) LPort=9009
FirewallRules: [{293F21E6-FC53-4AB2-8DE1-B1F802472BDA}] => (Allow) LPort=9009
FirewallRules: [{03A7BF72-BDDB-4F3D-A51A-1775DC880D05}] => (Allow) LPort=9009
FirewallRules: [{FEBCAD3C-181F-4349-B65C-04A6B4C2FCD4}] => (Allow) LPort=9009
FirewallRules: [{2D486012-E6ED-424F-BADD-5B1BA3C4EB09}] => (Allow) LPort=9009
FirewallRules: [{D4B70FB0-7A6B-4CFF-8099-DF947822F896}] => (Allow) LPort=9009
FirewallRules: [{BBC967CF-12D0-45B8-B7D2-76E3638E40F2}] => (Allow) LPort=9009
FirewallRules: [{F9B4C236-7DB5-4C3F-8464-F65D734C5B01}] => (Allow) LPort=9009
FirewallRules: [{244EB0C2-CE03-4AB5-B3DE-81D338F46049}] => (Allow) LPort=9009
FirewallRules: [{A894CA85-EFBA-4818-97E7-22FFCF26B8EE}] => (Allow) LPort=9009
FirewallRules: [{F3465A21-12B9-4E88-91C7-C7766F1C812A}] => (Allow) LPort=9009
FirewallRules: [{5C776A43-A290-4B72-8C49-2F9CE79EB0BD}] => (Allow) LPort=9009
FirewallRules: [{A0BF18F8-8696-44C3-A845-B567ECC97DD4}] => (Allow) LPort=9009
FirewallRules: [{DC07B8C6-963A-44EA-996B-871C3B627A37}] => (Allow) LPort=9009
FirewallRules: [{4880F839-2F3A-4F6E-9745-29E56A99F4AF}] => (Allow) LPort=9009
FirewallRules: [{51491E41-94B6-4776-960E-A2B354863B17}] => (Allow) LPort=9009
StartBatch:
del /s /q C:\Windows\SoftwareDistribution\download\*.*
ipconfig /flushdns
sfc /scannow
endbatch:
Reboot:
End::[/CODE]Запустите FRST.EXE/FRST64.EXE, нажмите один раз [B]Исправить[/B] и подождите. Программа создаст лог-файл ([B]Fixlog.txt[/B]). Упакуйте его в архив и прикрепите его к своему следующему сообщению.
Компьютер будет перезагружен автоматически.

Вложений: 1

Пожалуйста.

Переименуйте FRST.exe (или FRST64.exe) в uninstall.exe и запустите.
Компьютер перезагрузится.

На этом всё.

Вложений: 1

Сделал. Перезагрузил. Удалил Др.веб фаирвол. Сделал еще раз логи. Посмотрите, пожалуйста, еще 1 раз. Очень боюсь, что вдруг тройн остаться мог. Спасибо большое.

Чисто.

Спасибо огромное за помощь.