Вылазит постоянно сообщение адрес заблокирован у антивируса
Вылазит постоянно сообщение адрес заблокирован у антивируса
Вылазит постоянно сообщение адрес заблокирован у антивируса
Последний раз редактировалось linar5; 15.04.2025 в 18:12.
Надоело быть жертвой? Стань профи по информационной безопасности, получай самую свежую информацию об угрозах и средствах защиты от ведущего российского аналитического центра Anti-Malware.ru:
Уважаемый(ая) linar5, спасибо за обращение на наш форум!
Помощь в лечении компьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитой Autologger, подробнее можно прочитать в правилах оформления запроса о помощи.
Информация
Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом Помогите+.
Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста, поддержите проект.
Продолжать будете здесь, или на Кибере? Если здесь, выполните скрипт в AVZ из папки Autologger\AV\av_z.exe в безопасном режиме системы:Компьютер перезагрузится.Код:begin QuarantineFile('C:\Program Files (x86)\nodejs\nodeupdate.vbs', ''); QuarantineFile('C:\ProgramData\Google\Chrome\updater.exe', ''); QuarantineFile('C:\ProgramData\Microsoft\wext.vbs', ''); DeleteFile('C:\Program Files (x86)\nodejs\nodeupdate.vbs', '64'); DeleteFile('C:\ProgramData\Google\Chrome\updater.exe', '64'); DeleteFile('C:\ProgramData\Microsoft\wext.vbs', '64'); DeleteFile('C:\Users\PC\AppData\Local\Temp\Rar$EXa10428.38799\x64\CCleanerBugReport.exe', '32'); DeleteFile('C:\Users\PC\AppData\Roaming\Sandboxie\sandboxie.exe', '32'); DeleteFile('C:\Users\PC\AppData\Roaming\Sandboxie\sandboxie.exe', '64'); DeleteService('GoogleUpdateTaskMachineQC'); RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'GoogleUpdateTaskMachineQC'); DeleteSchedulerTask('C:\Windows\Task\CCleanerCrashReporting.job'); DeleteSchedulerTask('CCleanerCrashReporting'); DeleteSchedulerTask('CCleanerSkipUAC - PC'); DeleteSchedulerTask('MyNode'); DeleteSchedulerTask('OperaUpdateTask'); CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip'); ExecuteSysClean; ExecuteWizard('SCU', 2, 2, true); RebootWindows(false); end.
В папке с AVZ появится архив карантина quarantine.zip, упакуйте его в архив с паролем, выложите на файлообменник или в облако и дайте ссылку с паролем в личном сообщении.
Скачайте, распакуйте и запустите утилиту ClearLNK. Скопируйте текст ниже в окно утилиты и нажмите "Лечить".Отчёт о работе прикрепите.Код:>>> "C:\Users\1\Desktop\Opera.lnk" -> ["C:\Users\1\AppData\Local\Programs\Opera\launcher.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Repack by Fenixx\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC.lnk" -> ["E:\Games\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\bin\witcher2.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Repack by Fenixx\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\The Witcher 2.Assassins Of Kings.(Лаунчер).lnk" -> ["E:\Games\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\Launcher.exe"] >>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.10\Python 3.10 (64-bit).lnk" -> ["C:\Users\PC\AppData\Local\Programs\Python\Python310\python.exe"] >>> "C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk" -> ["C:\Windows\system32\WFS.exe" =>> /SendTo] >>> "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk" -> ["C:\Windows\system32\narrator.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk" -> ["C:\Windows\system32\SnippingTool.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Repack by Fenixx\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\The Witcher 2.Assassins Of Kings.(Настройки).lnk" -> ["E:\Games\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\bin\Configurator.exe"] >>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.10\IDLE (Python 3.10 64-bit).lnk" -> ["C:\Users\PC\AppData\Local\Programs\Python\Python310\pythonw.exe" =>> "C:\Users\PC\AppData\Local\Programs\Python\Python310\Lib\idlelib\idle.pyw"] >>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.10\Python 3.10 Module Docs (64-bit).lnk" -> ["C:\Users\PC\AppData\Local\Programs\Python\Python310\python.exe" =>> -m pydoc -b] >>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk" -> ["C:\Windows\system32\narrator.exe"] >>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk" -> ["C:\Windows\system32\osk.exe"] >>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk" -> ["C:\Windows\system32\WFS.exe" =>> /SendTo] >>> "C:\Users\PC\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk" -> ["C:\Windows\system32\mblctr.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect 1 L.E\Mass Effect 1 L.E.lnk" -> ["E:\Games\Mass Effect 1 L.E\Game\Launcher\MassEffectLauncher.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Erica\Erica.lnk" -> ["D:\Games\Erica\erica.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect 1 L.E\Uninstall Mass Effect 1 L.E.lnk" -> ["E:\Games\Mass Effect 1 L.E\Uninstall\unins000.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Repack by Fenixx\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\Деинсталлировать The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC.lnk" -> ["E:\Games\The Witcher 2.Assassins Of Kings.Enhanced Edition.v 3.4.4.1 + 12 DLC\Uninstall\unins000.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Erica\Uninstall Erica.lnk" -> ["D:\Games\Erica\unins000.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Super Seducer 3.lnk" -> ["D:\Games\SuperSeducer3\SuperSeducer3.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Prince of Persia - The Forgotten Sands\Prince of Persia - The Forgotten Sands.lnk" -> ["D:\Games\Prince of Persia - The Forgotten Sands\Prince of Persia.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Prince of Persia - The Forgotten Sands\Настройки.lnk" -> ["D:\Games\Prince of Persia - The Forgotten Sands\GameSettings.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Prince of Persia - The Forgotten Sands\Деинсталлировать Prince of Persia - The Forgotten Sands.lnk" -> ["D:\Games\Prince of Persia - The Forgotten Sands\unins000.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine tutorial.lnk" -> ["C:\Program Files\Cheat Engine 7.5\Tutorial-i386.exe"] >>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\poigraem\Король Покера 2.lnk" -> ["D:\Games\Governor of Poker 2 rus\GovernorofPoker2_PE.exe"] >>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Last Man\Uninstall.lnk" -> ["E:\Downloads\1\Last Man\uninstall.exe"] >>> "C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Last Man\Last Man.lnk" -> ["E:\Downloads\1\Last Man\Last_Man.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Witcher 3 - GOTY\Uninstall The Witcher 3 - GOTY.lnk" -> ["D:\Games\The Witcher 3 - GOTY\Uninstall\unins000.exe"] >>> "C:\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk" -> ["C:\Windows\system32\osk.exe"] >>> "C:\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk" -> ["C:\Windows\system32\narrator.exe"] >>> "C:\Users\1\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk" -> ["C:\Windows\system32\WFS.exe" =>> /SendTo] >>> "C:\Users\1\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk" -> ["C:\Windows\system32\mblctr.exe"] >>> "C:\Users\1\Desktop\Bannerlord.lnk" -> ["E:\Games\Mount & Blade II Bannerlord\bin\Win64_Shipping_Client\Bannerlord.exe"] >>> "C:\Users\1\Desktop\Civilization VI.lnk" -> ["D:\Games\Sid Meiers Civilization VI\Base\Binaries\Win64Steam\CivilizationVI_DX12.exe"] >>> "C:\Users\1\Desktop\Discord.lnk" -> ["C:\Users\1\AppData\Local\Discord\Update.exe" =>> --processStart Discord.exe] >>> "C:\Users\1\Desktop\GeForce Experience.lnk" -> ["C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe"] >>> "C:\Users\1\Desktop\Kingdom Rush HD.lnk" -> ["D:\Games\Kingdom Rush HD\Kingdom Rush.exe"] >>> "C:\Users\1\Desktop\PlagueInc.lnk" -> ["D:\Games\Plague Inc Evolved The Fake News\PlagueIncEvolved.exe"] >>> "C:\Users\1\Desktop\Telegram.lnk" -> ["C:\Users\1\AppData\Roaming\Telegram Desktop\Telegram.exe"] >>> "C:\Users\1\Desktop\Tor Browser 11.0.7.lnk" -> ["C:\Tor Browser 11.0.7 portable (TA-2111).exe"] >>> "C:\Users\1\Desktop\Torchlight III.lnk" -> ["D:\Games\Torchlight III\Frontiers.exe"] >>> "C:\Users\1\Desktop\Witcher 3.lnk" -> ["E:\Games\The Witcher 3 - Wild Hunt\bin\x64\witcher3.exe"] >>> "C:\Users\1\Desktop\Adobe Photoshop 2020.lnk" -> ["C:\Program Files\Adobe\Adobe Photoshop 2020\Photoshop.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Star Wars Jedi Fallen Order\Star Wars Jedi Fallen Order.lnk" -> ["E:\Games\Star Wars Jedi Fallen Order\SwGame\Binaries\Win64\starwarsjedifallenorder.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Star Wars Jedi Fallen Order\Uninstall Star Wars Jedi Fallen Order.lnk" -> ["E:\Games\Star Wars Jedi Fallen Order\Uninstall\unins000.exe"] >>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraCompare\IDM Error Reporting.lnk" -> ["C:\Users\PC\Desktop\IDMMonitor.exe"]
Скачайте Farbar Recovery Scan Tool или с зеркала и сохраните на Рабочем столе.
Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.
Запустите программу. Когда программа запустится, нажмите Да для соглашения с предупреждением.
Нажмите кнопку Сканировать.
После окончания сканирования будут созданы отчеты FRST.txt, Addition.txt в той же папке, откуда была запущена программа.
Прикрепите эти файлы к своему следующему сообщению (лучше оба в одном архиве).
WBR,
Vadim
Если тут быстрее ответят, то здесь буду продолжать. Я все сделал, в личку отправил. При сканировании он завис, ничего не происходит. Файлы прикрепляю.
Выполняйте также в безопасном режиме, после перезагрузки сделайте новые логи FRST.
Выделите и скопируйте в буфер обмена следующий код:Запустите FRST.EXE/FRST64.EXE, нажмите один раз Исправить и подождите. Программа создаст лог-файл (Fixlog.txt). Прикрепите его к своему следующему сообщению.Код:Start:: CloseProcesses: HKU\S-1-5-21-2548779362-2516317261-3690425480-1001\...\Run: [MOBA Trainer] => "C:\Users\PC\AppData\Local\Programs\mobatrainer\MOBA Trainer.exe" --hidden (Нет файла) Task: {EA5287FB-40D9-4C04-A86D-6257FC0F3CF4} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Нет файла) Task: {3D71D8C9-D0ED-48E5-BABC-950B377D57EB} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Нет файла) Task: {15A8EF92-94AF-4CB3-B56D-D08D82B8AE06} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe (Нет файла) Task: {F3602846-1CBB-4B1A-AE8F-1CA44A6C37EE} - System32\Tasks\OperaUpdate => C:\Windows\system32\cmd.exe [289792 2022-10-14] (Microsoft Windows -> Microsoft Corporation) -> /c auditpol /set /category:"Система" /success:enable && auditpol /set /category:"Подробное отслеживание" /subcategory:"Создание процесса" /success:enable <==== ВНИМАНИЕ C:\Users\PC\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\knpaahgfmjnnbcdjmedhfiocjafigamo C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbbimhdifknonpfpblipdagoamjaicin C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpfpmnhblodfgegbienkhfjlnjbaoaal C:\Users\PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extensions\nmbbdkebkicbknnajhdehfecmlocibpb S3 BITS_bkp; C:\Windows\System32\qmgr.dll [1481216 2022-10-14] (Microsoft Windows -> Microsoft Corporation) S2 dosvc_bkp; C:\Windows\system32\dosvc.dll [1503232 2022-10-14] (Microsoft Windows -> Microsoft Corporation) S2 GoogleUpdateTaskMachineQC; C:\ProgramData\Google\Chrome\updater.exe [422352 2025-04-15] (Tonalio GmbH -> Sandboxie-Plus.com) <==== ВНИМАНИЕ C:\ProgramData\Google\Chrome\updater.exe S2 UsoSvc_bkp; C:\Windows\system32\usosvc.dll [570368 2022-10-14] (Microsoft Windows -> Microsoft Corporation) S3 WaaSMedicSvc_bkp; C:\Windows\System32\WaaSMedicSvc.dll [427520 2022-10-14] (Microsoft Windows -> Microsoft Corporation) S3 wuauserv_bkp; C:\Windows\system32\wuaueng.dll [3406848 2022-10-14] (Microsoft Windows -> Microsoft Corporation) S2 RServer3; "C:\Windows\SysWOW64\rserver30\RServer3.exe" /service [X] S3 imdisk; \??\c:\users\pc\appdata\local\temp\jinn\isorun\x64\imdisk.sys [X] <==== ВНИМАНИЕ S1 raddrvv3; \??\C:\Windows\SysWOW64\rserver30\raddrvv3.sys [X] 2025-03-22 14:45 - 2025-04-15 23:03 - 000000000 ____D C:\Program Files (x86)\nodejs 2025-03-22 14:45 - 2025-04-15 21:54 - 000034707 _____ C:\Users\PC\ex-list2.json 2025-03-22 14:45 - 2025-04-15 21:54 - 000000391 _____ C:\Users\PC\bs-list.json 2025-03-22 14:45 - 2025-03-22 14:45 - 000000207 _____ C:\Users\PC\e-user.json 2025-03-22 14:45 - 2025-03-22 14:45 - 000000103 _____ C:\Users\PC\e-country.json 2025-04-15 17:43 - 2025-04-15 17:43 - 000000364 _____ () C:\Users\PC\nodejs.dat Unlock: C:\Users\1\AppData\Roaming\FileZilla Unlock: C:\Users\1\AppData\Local\FileZilla CustomCLSID: HKU\S-1-5-21-2548779362-2516317261-3690425480-1001_Classes\CLSID\{5C4D8D77-5B87-40CA-884E-F56858227E5C}\localserver32 -> C:\Users\PC\AppData\Local\Programs\TeamSpeak\notification_helper.exe => Нет файла ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => -> Нет файла ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => -> Нет файла ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => -> Нет файла ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => -> Нет файла ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> Нет файла ContextMenuHandlers1: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => -> Нет файла ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> Нет файла ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} => -> Нет файла ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => -> Нет файла ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> Нет файла ContextMenuHandlers6: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => -> Нет файла ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> Нет файла ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions StartRegedit: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BITS] "DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00 "Description"="@%SystemRoot%\\system32\\qmgr.dll,-1001" "DisplayName"="@%SystemRoot%\\system32\\qmgr.dll,-1000" "ErrorControl"=dword:00000001 "FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\ 00,01,00,00,00,60,ea,00,00,01,00,00,00,c0,d4,01,00,00,00,00,00,00,00,00,00 "ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ 74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\ 00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\ 6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,20,00,2d,00,70,00,00,\ 00 "ObjectName"="LocalSystem" "RequiredPrivileges"=hex(7):53,00,65,00,43,00,72,00,65,00,61,00,74,00,65,00,47,\ 00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,\ 67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,\ 00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\ 00,00,53,00,65,00,54,00,63,00,62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\ 00,67,00,65,00,00,00,53,00,65,00,41,00,73,00,73,00,69,00,67,00,6e,00,50,00,\ 72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,72,\ 00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,6e,00,\ 63,00,72,00,65,00,61,00,73,00,65,00,51,00,75,00,6f,00,74,00,61,00,50,00,72,\ 00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,44,00,65,00,\ 62,00,75,00,67,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\ 00,00,00 "ServiceSidType"=dword:00000001 "Start"=dword:00000002 "Type"=dword:00000020 "DelayedAutostart"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BITS\Parameters] "ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\ 00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\ 71,00,6d,00,67,00,72,00,2e,00,64,00,6c,00,6c,00,00,00 "ServiceDllUnloadOnStop"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BITS\Performance] "Close"="PerfMon_Close" "Collect"="PerfMon_Collect" "Library"="C:\\Windows\\System32\\bitsperf.dll" "Open"="PerfMon_Open" "InstallType"=dword:00000001 "PerfIniFile"="bitsctrs.ini" "First Counter"=dword:000021a8 "Last Counter"=dword:000021b8 "First Help"=dword:000021a9 "Last Help"=dword:000021b9 "Object List"="8616" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BITS\Security] "Security"=hex:01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00,00,34,00,00,00,02,\ 00,20,00,01,00,00,00,02,c0,18,00,00,00,0c,00,01,02,00,00,00,00,00,05,20,00,\ 00,00,20,02,00,00,02,00,5c,00,04,00,00,00,00,02,14,00,ff,01,0f,00,01,01,00,\ 00,00,00,00,05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,\ 20,00,00,00,20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,\ 00,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,01,02,\ 00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,\ 00,20,02,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DoSvc] "DependOnService"=hex(7):72,00,70,00,63,00,73,00,73,00,00,00,00,00 "Description"="@%systemroot%\\system32\\dosvc.dll,-101" "DisplayName"="@%systemroot%\\system32\\dosvc.dll,-100" "ErrorControl"=dword:00000001 "FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\ 00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00,00,00,00,00,00,00,00,00 "ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ 74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\ 00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\ 6b,00,20,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,53,00,65,00,72,00,76,\ 00,69,00,63,00,65,00,20,00,2d,00,70,00,00,00 "LaunchProtected"=dword:00000002 "ObjectName"="NT Authority\\NetworkService" "ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\ 00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\ 64,00,6f,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00 "ServiceDllUnloadOnStop"=dword:00000001 "ServiceSidType"=dword:00000001 "Start"=dword:00000002 "SvcMemHardLimitInMB"=dword:00000027 "SvcMemMidLimitInMB"=dword:0000001b "SvcMemSoftLimitInMB"=dword:0000000f "Type"=dword:00000010 "DelayedAutostart"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DoSvc\Security] "Security"=hex:01,00,14,80,a0,00,00,00,ac,00,00,00,14,00,00,00,30,00,00,00,02,\ 00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ 00,00,02,00,70,00,04,00,00,00,00,00,14,00,9d,00,02,00,01,01,00,00,00,00,00,\ 05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\ 20,02,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00,00,00,05,12,00,00,00,00,\ 00,28,00,22,00,02,00,01,06,00,00,00,00,00,05,50,00,00,00,4d,f8,19,b6,b3,a7,\ 7f,e3,93,9a,10,ee,20,5d,51,ab,9b,39,b9,82,01,01,00,00,00,00,00,05,12,00,00,\ 00,01,01,00,00,00,00,00,05,12,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DoSvc\TriggerInfo] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DoSvc\TriggerInfo\0] "Action"=dword:00000001 "Data0"=hex:75,10,bc,a3,29,01,c6,41 "DataType0"=dword:00000001 "GUID"=hex:16,28,7a,2d,5e,0c,fc,45,9c,e7,57,0e,5e,cd,e9,c9 "Type"=dword:00000007 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DoSvc\TriggerInfo\1] "Action"=dword:00000001 "GUID"=hex:e6,ca,9f,65,db,5b,a9,4d,b1,ff,ca,2a,17,8d,46,e0 "Type"=dword:00000005 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UsoSvc] "DelayedAutoStart"=dword:00000001 "DependOnService"=hex(7):72,00,70,00,63,00,73,00,73,00,00,00,00,00 "Description"="@%systemroot%\\system32\\usosvc.dll,-102" "DisplayName"="@%systemroot%\\system32\\usosvc.dll,-101" "ErrorControl"=dword:00000001 "FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\ 00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00 "ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\ 74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\ 00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\ 6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,20,00,2d,00,70,00,00,\ 00 "ObjectName"="LocalSystem" "PreshutdownTimeout"=dword:0036ee80 "RequiredPrivileges"=hex(7):53,00,65,00,41,00,75,00,64,00,69,00,74,00,50,00,72,\ 00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,\ 65,00,61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,\ 00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,00,\ 61,00,74,00,65,00,50,00,61,00,67,00,65,00,46,00,69,00,6c,00,65,00,50,00,72,\ 00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,54,00,63,00,\ 62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\ 00,41,00,73,00,73,00,69,00,67,00,6e,00,50,00,72,00,69,00,6d,00,61,00,72,00,\ 79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\ 00,67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,\ 6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,\ 00,00,00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00,73,00,65,00,51,00,\ 75,00,6f,00,74,00,61,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,\ 00,00,00,53,00,65,00,53,00,68,00,75,00,74,00,64,00,6f,00,77,00,6e,00,50,00,\ 72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,44,00,65,\ 00,62,00,75,00,67,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\ 00,00,53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,00,72,00,69,00,76,\ 00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,74,00,\ 6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\ 00,53,00,65,00,53,00,65,00,63,00,75,00,72,00,69,00,74,00,79,00,50,00,72,00,\ 69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,54,00,61,00,6b,\ 00,65,00,4f,00,77,00,6e,00,65,00,72,00,73,00,68,00,69,00,70,00,50,00,72,00,\ 69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,4c,00,6f,00,61,\ 00,64,00,44,00,72,00,69,00,76,00,65,00,72,00,50,00,72,00,69,00,76,00,69,00,\ 6c,00,65,00,67,00,65,00,00,00,53,00,65,00,4d,00,61,00,6e,00,61,00,67,00,65,\ 00,56,00,6f,00,6c,00,75,00,6d,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,\ 65,00,67,00,65,00,00,00,53,00,65,00,53,00,79,00,73,00,74,00,65,00,6d,00,45,\ 00,6e,00,76,00,69,00,72,00,6f,00,6e,00,6d,00,65,00,6e,00,74,00,50,00,72,00,\ 69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,\ 00,61,00,74,00,65,00,53,00,79,00,6d,00,62,00,6f,00,6c,00,69,00,63,00,4c,00,\ 69,00,6e,00,6b,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\ 00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00,73,00,65,00,42,00,61,00,\ 73,00,65,00,50,00,72,00,69,00,6f,00,72,00,69,00,74,00,79,00,50,00,72,00,69,\ 00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00 "ServiceSidType"=dword:00000001 "Start"=dword:00000002 "Type"=dword:00000020 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UsoSvc\Parameters] "ServiceDll"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,\ 00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\ 75,00,73,00,6f,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00 "ServiceDllUnloadOnStop"=dword:00000001 "ServiceMain"="ServiceMain" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\UsoSvc\Security] "Security"=hex:01,00,14,80,78,00,00,00,84,00,00,00,14,00,00,00,30,00,00,00,02,\ 00,1c,00,01,00,00,00,02,80,14,00,ff,00,0f,00,01,01,00,00,00,00,00,01,00,00,\ 00,00,02,00,48,00,03,00,00,00,00,00,14,00,9d,00,02,00,01,01,00,00,00,00,00,\ 05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\ 20,02,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00,00,00,05,12,00,00,00,01,\ 01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WaaSMedicSvc] "DependOnService"=hex(7):72,00,70,00,63,00,73,00,73,00,00,00,00,00 "Description"="@WaaSMedicSvcImpl.dll,-101" "DisplayName"="@WaaSMedicSvcImpl.dll,-100" "ErrorControl"=dword:00000001 "FailureActions"=hex:84,03,00,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\ 00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00 "ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\ 74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\ 00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\ 6b,00,20,00,77,00,75,00,73,00,76,00,63,00,73,00,20,00,2d,00,70,00,00,00 "LaunchProtected"=dword:00000002 "ObjectName"="LocalSystem" "RequiredPrivileges"=hex(7):53,00,65,00,54,00,63,00,62,00,50,00,72,00,69,00,76,\ 00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,68,00,61,00,6e,00,\ 67,00,65,00,4e,00,6f,00,74,00,69,00,66,00,79,00,50,00,72,00,69,00,76,00,69,\ 00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,\ 73,00,6f,00,6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\ 00,67,00,65,00,00,00,53,00,65,00,54,00,61,00,6b,00,65,00,4f,00,77,00,6e,00,\ 65,00,72,00,73,00,68,00,69,00,70,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\ 00,67,00,65,00,00,00,53,00,65,00,53,00,65,00,63,00,75,00,72,00,69,00,74,00,\ 79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\ 00,42,00,61,00,63,00,6b,00,75,00,70,00,50,00,72,00,69,00,76,00,69,00,6c,00,\ 65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,74,00,6f,00,72,00,65,\ 00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,\ 4d,00,61,00,6e,00,61,00,67,00,65,00,56,00,6f,00,6c,00,75,00,6d,00,65,00,50,\ 00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00 "ServiceSidType"=dword:00000001 "Start"=dword:00000003 "Type"=dword:00000020 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WaaSMedicSvc\Parameters] "ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\ 00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\ 57,00,61,00,61,00,53,00,4d,00,65,00,64,00,69,00,63,00,53,00,76,00,63,00,2e,\ 00,64,00,6c,00,6c,00,00,00 "ServiceDllUnloadOnStop"=dword:00000001 "ServiceMain"="ServiceMain" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WaaSMedicSvc\Security] "Security"=hex:01,00,14,80,78,00,00,00,84,00,00,00,14,00,00,00,30,00,00,00,02,\ 00,1c,00,01,00,00,00,02,80,14,00,ff,00,0f,00,01,01,00,00,00,00,00,01,00,00,\ 00,00,02,00,48,00,03,00,00,00,00,00,14,00,9d,00,02,00,01,01,00,00,00,00,00,\ 05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\ 20,02,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00,00,00,05,12,00,00,00,01,\ 01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wuauserv] "DependOnService"=hex(7):72,00,70,00,63,00,73,00,73,00,00,00,00,00 "Description"="@%systemroot%\\system32\\wuaueng.dll,-106" "DisplayName"="@%systemroot%\\system32\\wuaueng.dll,-105" "ErrorControl"=dword:00000001 "FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\ 00,01,00,00,00,60,ea,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\ 74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\ 00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\ 6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,20,00,2d,00,70,00,00,\ 00 "ObjectName"="LocalSystem" "RequiredPrivileges"=hex(7):53,00,65,00,41,00,75,00,64,00,69,00,74,00,50,00,72,\ 00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,\ 65,00,61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,\ 00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,00,\ 61,00,74,00,65,00,50,00,61,00,67,00,65,00,46,00,69,00,6c,00,65,00,50,00,72,\ 00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,54,00,63,00,\ 62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\ 00,41,00,73,00,73,00,69,00,67,00,6e,00,50,00,72,00,69,00,6d,00,61,00,72,00,\ 79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\ 00,67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,\ 6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,\ 00,00,00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00,73,00,65,00,51,00,\ 75,00,6f,00,74,00,61,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,\ 00,00,00,53,00,65,00,53,00,68,00,75,00,74,00,64,00,6f,00,77,00,6e,00,50,00,\ 72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,44,00,65,\ 00,62,00,75,00,67,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\ 00,00,53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,00,72,00,69,00,76,\ 00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,74,00,\ 6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\ 00,53,00,65,00,53,00,65,00,63,00,75,00,72,00,69,00,74,00,79,00,50,00,72,00,\ 69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,54,00,61,00,6b,\ 00,65,00,4f,00,77,00,6e,00,65,00,72,00,73,00,68,00,69,00,70,00,50,00,72,00,\ 69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,4c,00,6f,00,61,\ 00,64,00,44,00,72,00,69,00,76,00,65,00,72,00,50,00,72,00,69,00,76,00,69,00,\ 6c,00,65,00,67,00,65,00,00,00,53,00,65,00,4d,00,61,00,6e,00,61,00,67,00,65,\ 00,56,00,6f,00,6c,00,75,00,6d,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,\ 65,00,67,00,65,00,00,00,53,00,65,00,53,00,79,00,73,00,74,00,65,00,6d,00,45,\ 00,6e,00,76,00,69,00,72,00,6f,00,6e,00,6d,00,65,00,6e,00,74,00,50,00,72,00,\ 69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,\ 00,61,00,74,00,65,00,53,00,79,00,6d,00,62,00,6f,00,6c,00,69,00,63,00,4c,00,\ 69,00,6e,00,6b,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\ 00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00,73,00,65,00,42,00,61,00,\ 73,00,65,00,50,00,72,00,69,00,6f,00,72,00,69,00,74,00,79,00,50,00,72,00,69,\ 00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00 "ServiceSidType"=dword:00000001 "Start"=dword:00000003 "SvcMemHardLimitInMB"=dword:000000f6 "SvcMemMidLimitInMB"=dword:000000a7 "SvcMemSoftLimitInMB"=dword:00000058 "Type"=dword:00000020 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wuauserv\Parameters] "ServiceDll"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,\ 00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\ 77,00,75,00,61,00,75,00,65,00,6e,00,67,00,2e,00,64,00,6c,00,6c,00,00,00 "ServiceDllUnloadOnStop"=dword:00000001 "ServiceMain"="WUServiceMain" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wuauserv\Security] "Security"=hex:01,00,14,80,78,00,00,00,84,00,00,00,14,00,00,00,30,00,00,00,02,\ 00,1c,00,01,00,00,00,02,80,14,00,ff,00,0f,00,01,01,00,00,00,00,00,01,00,00,\ 00,00,02,00,48,00,03,00,00,00,00,00,14,00,9d,00,02,00,01,01,00,00,00,00,00,\ 05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\ 20,02,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00,00,00,05,12,00,00,00,01,\ 01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wuauserv\TriggerInfo] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wuauserv\TriggerInfo\0] "Type"=dword:00000005 "Action"=dword:00000001 "Guid"=hex:e6,ca,9f,65,db,5b,a9,4d,b1,ff,ca,2a,17,8d,46,e0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wuauserv\TriggerInfo\1] "Type"=dword:00000005 "Action"=dword:00000001 "Guid"=hex:c8,46,fb,54,89,f0,4c,46,b1,fd,59,d1,b6,2c,3b,50 EndRegedit: Reboot: End::
Компьютер будет перезагружен.
WBR,
Vadim
Я не понял из сообщения куда код вставлять и поэтому вставил в frst64.exe в поиск и нажал исправить. В следующих сообщениях, пожалуйста, пишите куда вставлять код.
Никуда вставлять не надо. он берёт из буфера обмена. И дважды делаь исправление не стоило, результат первого затёрся. Но всё сработало, как и задумано, в итоге, проблема должна быть решена.
Деинсталлируйте Bonjour, устанавливается допом к другим программам, не нужен. И Adobe Flash Player 32 PPAPI - устарел и не используется.
Обновите WinRar: Российские хакеры используют недавнюю уязвимость в WinRAR.
Уязвимость в архиваторе WinRAR позволяет обойти метку Mark-of-the-Web.
Переименуйте FRST.exe (или FRST64.exe) в uninstall.exe и запустите. Логи, карантин и другие файлы, созданные программой, будут удалены.
Компьютер перезагрузится.
WBR,
Vadim
спс, все работает
Уважаемый(ая) linar5, наши специалисты оказали Вам всю возможную помощь по вашему обращению.
В целях поддержания безопасности вашего компьютера настоятельно рекомендуем:
Чтобы всегда быть в курсе актуальных угроз в области информационной безопасности и сохранять свой компьютер защищенным, рекомендуем следить за последними новостями ИТ-сферы портала Anti-Malware.ru:
Надеемся больше никогда не увидеть ваш компьютер зараженным!
Если Вас не затруднит, пополните пожалуйста нашу базу безопасных файлов.
Ваши права в разделе
