Здравейте и за много години. Мисля че системата ми е заразена с вируса от заглавието който откри defender-а и го постави под карантина защото свалях една програма и след стартирането и браузера ми се затвори сам. След което като отворих браузера си възстанових затворените раздели а преди това бях отворил и раздел в фейса. И като се опитах да влезна не ми даде и на пощата си видях че имам няколко имейла че ми е сменена паролата както и имейла същото така ми е премахнат и телефонния номер който си бях добавил. Дадох забравена парола но без никакъв резултат единнствено от забравена парола като избрах успоях да си въведа друг имейл но като избера забравена парола и да ми изпратят код се показва и имейла на нападателя и оставям с вързани ръце. Ако може член от екипа да провери дали това е наистина е вирус или не и ако е и може да се премахне дали ще има ефект върху възстановяването на акаунта ми прикачвам двата лог файла от frst.

https://dox.abv.bg/download?id=a36b3001c2# - Линк за сваляне

https://dox.abv.bg/download?id=4ad0eaf506# - Линк за сваляне

Здравейте и Честита Нова Година..! Да ,действително Windows Defender е открил и спрял :

Цитат

VirTool:Win32/DefenderTamperingRestore

и 

Trojan:Win32/SExec.SB!tsk - троянски кон

...не съм сигурен какво се е случило. Ще прегледам дневниците , и ще видим дали можем да поправим това.

 

 

Фикс с Farbar Recovery Scan Tool

• Щракнете с десния бутон върху иконата FRST и изберете Изпълнете като администратор
• Маркирайте  информацията от карето по долу , след което натиснете клавишите Ctrl + C едновременно и текстът ще бъде копиран
• Няма нужда да поставяте информацията , FRST ще я направи вместо вас.

Start::
SystemRestore: On
CreateRestorePoint:
CloseProcesses:

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall: Restriction <==== ATTENTION
GroupPolicy: Restriction - Edge <==== ATTENTION
GroupPolicy\User: Restriction - Edge <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {C4C7FC4A-4859-44B7-97D1-3DF5D45FF121} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
Task: {44E12959-B5AE-4583-855B-8622E79315FA} - System32\Tasks\MicrosoftEdgeUpdateTaskMachineCore{29E7FF16-A45D-4783-9A73-A812ED3F334A} => C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe  /c (No File)
Task: {31AF157E-83B7-4935-A74F-1885328D0D4B} - System32\Tasks\MicrosoftEdgeUpdateTaskMachineUA{BEC44894-4591-4579-8108-84271416E7DD} => C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe  /ua /installsource scheduler (No File)
Task: {629890AB-F0AA-413E-B2A0-0BB2B2DF33A8} - System32\Tasks\MPGPH1 HR => C:\ProgramData\MPGPH1\MPGPH1.exe  (No File) <==== ATTENTION
Task: {F4AE607C-77E7-4840-9DF3-B9404AAFCD4F} - System32\Tasks\MPGPH1 LG => C:\ProgramData\MPGPH1\MPGPH1.exe  (No File) <==== ATTENTION

Unlock: C:\Windows\SysWOW64\ljzxlijb
Folder: C:\Windows\SysWOW64\ljzxlijb

C:\Windows\Temp\*.*
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp

Removeproxy:
EmptyTemp:
Reboot:
End::

 

ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на  операционната ви система

Следните директории се изпразват:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Натиснете бутона Fix само веднъж и изчакайте.

Забележка:    Не е необходимо да поставяте скрипта в FRST .
Рестартирайте компютъра, ако бъдете подканени.
Когато поправката е завършена, FRST ще генерира дневник на същото място, от което е стартиран (Fixlog.txt)
Моля, копирайте и поставете съдържанието му във вашия отговор.

Ето го лога.

Цитат

Fix result of Farbar Recovery Scan Tool (x64) Version: 01.01.2024
Ran by VLADO (02-01-2024 15:17:24) Run:1
Running from C:\Users\VLADO\Desktop
Loaded Profiles: VLADO
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start::
SystemRestore: On
CreateRestorePoint:
CloseProcesses:

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall: Restriction <==== ATTENTION
GroupPolicy: Restriction - Edge <==== ATTENTION
GroupPolicy\User: Restriction - Edge <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {C4C7FC4A-4859-44B7-97D1-3DF5D45FF121} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
Task: {44E12959-B5AE-4583-855B-8622E79315FA} - System32\Tasks\MicrosoftEdgeUpdateTaskMachineCore{29E7FF16-A45D-4783-9A73-A812ED3F334A} => C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe  /c (No File)
Task: {31AF157E-83B7-4935-A74F-1885328D0D4B} - System32\Tasks\MicrosoftEdgeUpdateTaskMachineUA{BEC44894-4591-4579-8108-84271416E7DD} => C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe  /ua /installsource scheduler (No File)
Task: {629890AB-F0AA-413E-B2A0-0BB2B2DF33A8} - System32\Tasks\MPGPH1 HR => C:\ProgramData\MPGPH1\MPGPH1.exe  (No File) <==== ATTENTION
Task: {F4AE607C-77E7-4840-9DF3-B9404AAFCD4F} - System32\Tasks\MPGPH1 LG => C:\ProgramData\MPGPH1\MPGPH1.exe  (No File) <==== ATTENTION

Unlock: C:\Windows\SysWOW64\ljzxlijb
Folder: C:\Windows\SysWOW64\ljzxlijb

C:\Windows\Temp\*.*
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp

Removeproxy:
EmptyTemp:
Reboot:
End::

*****************

SystemRestore: On => completed
Restore point was successfully created.
Processes closed successfully.
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => removed successfully
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate => removed successfully
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall => removed successfully

"C:\Windows\system32\GroupPolicy\Machine" folder move:

C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully

"C:\Windows\system32\GroupPolicy\User" folder move:

C:\Windows\system32\GroupPolicy\User => moved successfully
C:\ProgramData\NTUSER.pol => moved successfully
HKLM\SOFTWARE\Policies\Mozilla => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C4C7FC4A-4859-44B7-97D1-3DF5D45FF121}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C4C7FC4A-4859-44B7-97D1-3DF5D45FF121}" => removed successfully
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{44E12959-B5AE-4583-855B-8622E79315FA}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{44E12959-B5AE-4583-855B-8622E79315FA}" => removed successfully
C:\Windows\System32\Tasks\MicrosoftEdgeUpdateTaskMachineCore{29E7FF16-A45D-4783-9A73-A812ED3F334A} => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MicrosoftEdgeUpdateTaskMachineCore{29E7FF16-A45D-4783-9A73-A812ED3F334A}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{31AF157E-83B7-4935-A74F-1885328D0D4B}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{31AF157E-83B7-4935-A74F-1885328D0D4B}" => removed successfully
C:\Windows\System32\Tasks\MicrosoftEdgeUpdateTaskMachineUA{BEC44894-4591-4579-8108-84271416E7DD} => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MicrosoftEdgeUpdateTaskMachineUA{BEC44894-4591-4579-8108-84271416E7DD}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{629890AB-F0AA-413E-B2A0-0BB2B2DF33A8}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{629890AB-F0AA-413E-B2A0-0BB2B2DF33A8}" => removed successfully
C:\Windows\System32\Tasks\MPGPH1 HR => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MPGPH1 HR" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{F4AE607C-77E7-4840-9DF3-B9404AAFCD4F}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F4AE607C-77E7-4840-9DF3-B9404AAFCD4F}" => removed successfully
C:\Windows\System32\Tasks\MPGPH1 LG => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MPGPH1 LG" => removed successfully
"C:\Windows\SysWOW64\ljzxlijb" => was unlocked

========================= Folder: C:\Windows\SysWOW64\ljzxlijb ========================

2024-01-02 11:19 - 2024-01-02 11:19 - 015277568 ____A [0727708B994F1E2DE4B345FFB2BE4B4F] () [File not signed] C:\Windows\SysWOW64\ljzxlijb\eqgthgyc.exe

====== End of Folder: ======

=========== "C:\Windows\Temp\*.*" ==========

C:\Windows\Temp\MpSigStub.log => moved successfully

========= End -> "C:\Windows\Temp\*.*" ========

=========== "C:\WINDOWS\system32\*.tmp" ==========

not found

========= End -> "C:\WINDOWS\system32\*.tmp" ========

=========== "C:\WINDOWS\syswow64\*.tmp" ==========

not found

========= End -> "C:\WINDOWS\syswow64\*.tmp" ========

=========== "C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp" ==========

not found

========= End -> "C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp" ========

========= RemoveProxy: =========

"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
"HKU\S-1-5-21-1171116283-1440808761-3296070194-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\S-1-5-21-1171116283-1440808761-3296070194-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully

========= End of RemoveProxy: =========

=========== EmptyTemp: ==========

FlushDNS => completed
BITS transfer queue => 1310720 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 52034501 B
Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 0 B
Windows/system/drivers => 0 B
Edge => 0 B
Chrome => 599298862 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 12796 B
LocalService => 20318 B
NetworkService => 20318 B
VLADO => 40238156 B

RecycleBin => 0 B
EmptyTemp: => 660.8 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 15:18:09 ====

 

Благодаря..! Моля, направете това:

 

Фикс с Farbar Recovery Scan Tool

• Щракнете с десния бутон върху иконата FRST и изберете Изпълнете като администратор
• Маркирайте  информацията от карето по долу , след което натиснете клавишите Ctrl + C едновременно и текстът ще бъде копиран
• Няма нужда да поставяте информацията , FRST ще я направи вместо вас

Start::
CloseProcesses:

S2 ljzxlijb; C:\Windows\SysWOW64\ljzxlijb\eqgthgyc.exe
C:\Windows\SysWOW64\ljzxlijb\eqgthgyc.exe
C:\Windows\SysWOW64\ljzxlijb

EmptyTemp:
End::

 

ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на  операционната ви система

Натиснете бутона Fix само веднъж и изчакайте.

Забележка:    Не е необходимо да поставяте скрипта в FRST .
Рестартирайте компютъра, ако бъдете подканени.
Когато поправката е завършена, FRST ще генерира дневник на същото място, от което е стартиран (Fixlog.txt)
Моля, копирайте и поставете съдържанието му във вашия отговор.

преди 4 минути, icotonev написа:

Благодаря..! Моля, направете това:

 

Фикс с Farbar Recovery Scan Tool

• Щракнете с десния бутон върху иконата FRST и изберете Изпълнете като администратор
• Маркирайте  информацията от карето по долу , след което натиснете клавишите Ctrl + C едновременно и текстът ще бъде копиран
• Няма нужда да поставяте информацията , FRST ще я направи вместо вас

Start::
CloseProcesses:

S2 ljzxlijb; C:\Windows\SysWOW64\ljzxlijb\eqgthgyc.exe
C:\Windows\SysWOW64\ljzxlijb\eqgthgyc.exe
C:\Windows\SysWOW64\ljzxlijb

EmptyTemp:
End::

 

•  

публикувано преди 14 минути

Здравейте и Честита Нова Година..! Да ,действително Windows Defender е открил и спрял :

  Цитат

VirTool:Win32/DefenderTamperingRestore

и 

Trojan:Win32/SExec.SB!tsk - троянски кон

...не съм сигурен какво се е случило. Ще прегледам дневниците , и ще видим дали можем да поправим това.

 

 

Фикс с Farbar Recovery Scan Tool

• Щракнете с десния бутон върху иконата FRST и изберете Изпълнете като администратор
• Маркирайте  информацията от карето по долу , след което натиснете клавишите Ctrl + C едновременно и текстът ще бъде копиран
• Няма нужда да поставяте информацията , FRST ще я направи вместо вас.

Start::
SystemRestore: On
CreateRestorePoint:
CloseProcesses:

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall: Restriction <==== ATTENTION
GroupPolicy: Restriction - Edge <==== ATTENTION
GroupPolicy\User: Restriction - Edge <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {C4C7FC4A-4859-44B7-97D1-3DF5D45FF121} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
Task: {44E12959-B5AE-4583-855B-8622E79315FA} - System32\Tasks\MicrosoftEdgeUpdateTaskMachineCore{29E7FF16-A45D-4783-9A73-A812ED3F334A} => C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe  /c (No File)
Task: {31AF157E-83B7-4935-A74F-1885328D0D4B} - System32\Tasks\MicrosoftEdgeUpdateTaskMachineUA{BEC44894-4591-4579-8108-84271416E7DD} => C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe  /ua /installsource scheduler (No File)
Task: {629890AB-F0AA-413E-B2A0-0BB2B2DF33A8} - System32\Tasks\MPGPH1 HR => C:\ProgramData\MPGPH1\MPGPH1.exe  (No File) <==== ATTENTION
Task: {F4AE607C-77E7-4840-9DF3-B9404AAFCD4F} - System32\Tasks\MPGPH1 LG => C:\ProgramData\MPGPH1\MPGPH1.exe  (No File) <==== ATTENTION

Unlock: C:\Windows\SysWOW64\ljzxlijb
Folder: C:\Windows\SysWOW64\ljzxlijb

C:\Windows\Temp\*.*
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
C:\Windows\System32\config\systemprofile\AppData\Local\*.tmp

Removeproxy:
EmptyTemp:
Reboot:
End::

 

ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на  операционната ви система

Натиснете бутона Fix само веднъж и изчакайте.

Забележка:    Не е необходимо да поставяте скрипта в FRST .
Рестартирайте компютъра, ако бъдете подканени.
Когато поправката е завършена, FRST ще генерира дневник на същото място, от което е стартиран (Fixlog.txt)
Моля, копирайте и поставете съдържанието му във вашия отговор.

Извинявам се за тъпия въпрос но и двата фикса ли да пусна.

току-що, vlado1985 написа:

Извинявам се за тъпия въпрос но и двата фикса ли да пусна.

Не ,само втория ...нещо при копирането се получи ... коригирах поста си..! 

Да и аз като рефрешнах страницата видях че само единия фикс стои и го изпълних.

Цитат

Fix result of Farbar Recovery Scan Tool (x64) Version: 01.01.2024
Ran by VLADO (02-01-2024 15:55:54) Run:2
Running from C:\Users\VLADO\Desktop
Loaded Profiles: VLADO
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start::
CloseProcesses:

S2 ljzxlijb; C:\Windows\SysWOW64\ljzxlijb\eqgthgyc.exe
C:\Windows\SysWOW64\ljzxlijb\eqgthgyc.exe
C:\Windows\SysWOW64\ljzxlijb

EmptyTemp:
End::
*****************

Processes closed successfully.
"HKLM\System\CurrentControlSet\Services\ljzxlijb" => removed successfully
ljzxlijb => service removed successfully
C:\Windows\SysWOW64\ljzxlijb\eqgthgyc.exe => moved successfully

"C:\Windows\SysWOW64\ljzxlijb" folder move:

C:\Windows\SysWOW64\ljzxlijb => moved successfully

=========== EmptyTemp: ==========

FlushDNS => completed
BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 7426944 B
Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 0 B
Windows/system/drivers => 0 B
Edge => 0 B
Chrome => 204436940 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 0 B
VLADO => 45781 B

RecycleBin => 0 B
EmptyTemp: => 202.1 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 15:56:00 ====

 

Чудесно..! Да ми кажете сега има ли някаква промяна по системата ви..? 

....и да направим повторна проверка така:

FRST сканиране

    Щракнете двукратно върху FRST.exe / FRST64.exe, за да го стартирате.
    Натиснете бутона за  сканиране.
    Когато приключи, той ще създаде  два лог файла с името FRST.txt и Addition.txt, в същата директория, от която е стартиран инструментът.
    Моля, копирайте и поставете двата файла в следващия си отговор.

Значи преди да пусна темата и до преди малко процесора постоянно товареше нещо без видима причина но сега вече е по добре. Но си оставя другия проблем с фейс акаунта ми и на новата поща на която изпращам да получа код вече и код не пристига а като избера забравена парола се вижда новия ми имейл.

Цитат

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 01.01.2024
Ran by VLADO (administrator) on DESKTOP-7G3RDAC (02-01-2024 16:11:39)
Running from C:\Users\VLADO\Desktop\FRST64.exe
Loaded Profiles: VLADO
Platform: Microsoft Windows 11 Enterprise Version 23H2 22631.2861 (X64) Language: Български (България)
Default browser: "D:\GoogleChromePortable\App\Chrome-bin\chrome.exe" --single-argument %1
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(explorer.exe ->) (Google LLC -> Google LLC) D:\GoogleChromePortable\App\Chrome-bin\chrome.exe <9>
(explorer.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(services.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Program Files\Microsoft Update Health Tools\uhssvc.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23110.3-0\MsMpEng.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23110.3-0\NisSrv.exe
(svchost.exe ->) (Microsoft Windows -> ) C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_423.30700.0.0_x64__cw5n1h2txyewy\Dashboard\WidgetService.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\UUS\amd64\MoUsoCoreWorker.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [Lightshot] => C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe [226728 2019-07-21] (Kilonova LLC -> )
HKLM\Software\Policies\...\system: [EnableSmartScreen] 0
HKU\S-1-5-21-1171116283-1440808761-3296070194-1001\...\Run: [PicPick Start] => C:\Program Files (x86)\PicPick\picpick.exe [32926768 2022-11-20] (NGWIN Software co. -> NGWIN)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{9459C573-B17A-45AE-9F64-1857B5D58CEE}] -> "C:\Program Files (x86)\Microsoft\Edge\Application\120.0.2210.91\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable

==================== Scheduled Tasks (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {BA9A6CF2-D37A-4BB7-8258-CC196238B7EA} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23110.3-0\MpCmdRun.exe [1608808 2023-12-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {5DA69AE9-46CE-478B-9741-E0E92DE81412} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23110.3-0\MpCmdRun.exe [1608808 2023-12-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {2921E37E-BCED-479D-8EF7-13514FE37204} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23110.3-0\MpCmdRun.exe [1608808 2023-12-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {F490CF31-5903-4BE4-846F-1B17D00DC2D0} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23110.3-0\MpCmdRun.exe [1608808 2023-12-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {0986162E-0E3A-409C-B0E1-4E636F364026} - System32\Tasks\update-S-1-5-21-1171116283-1440808761-3296070194-1001 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [414872 2017-04-12] (OOO Lightshot -> TODO: <Company name>)
Task: {CEA6BC50-3A25-4249-9351-9D3AC0C019B4} - System32\Tasks\update-sys => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [414872 2017-04-12] (OOO Lightshot -> TODO: <Company name>)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\update-S-1-5-21-1171116283-1440808761-3296070194-1001.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: C:\Windows\Tasks\update-sys.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 212.39.90.52 212.39.90.53
Tcpip\..\Interfaces\{b778d47a-15a1-455f-92f3-2fb4e9823b34}: [DhcpNameServer] 212.39.90.52 212.39.90.53

Edge: 
=======
Edge Profile: C:\Users\VLADO\AppData\Local\Microsoft\Edge\User Data\Default [2023-11-26]
Edge Extension: (Google Документи офлайн) - C:\Users\VLADO\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2023-11-26]
Edge Extension: (Edge relevant text changes) - C:\Users\VLADO\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2023-11-26]

Chrome: 
=======
CHR Profile: C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default [2024-01-02]
CHR Notifications: Default -> hxxps://mail.google.com; hxxps://web.skype.com; hxxps://www.facebook.com
CHR HomePage: Default -> hxxp://www.google.bg/
CHR StartupUrls: Default -> "hxxp://www.google.bg/"
CHR Extension: (Google Преводач) - C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2023-12-22]
CHR Extension: (Torrent Scanner) - C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default\Extensions\aegnopegbbhjeeiganiajffnalhlkkjb [2023-12-22]
CHR Extension: (AdGuard рекламен блокер) - C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgnkhhnnamicmpeenaelnjfhikgbkllg [2023-12-24]
CHR Extension: (uBlock Origin) - C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2023-12-22]
CHR Extension: (App for Skp Web) - C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckphpjbkimigoeccikelnkfnilnjmaha [2023-12-22]
CHR Extension: (Notifier for Gmail™) - C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcjichoefijpinlfnjghokpkojhlhkgl [2023-12-22]
CHR Extension: (Tab Suspender) - C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default\Extensions\fiabciakcmgepblmdkmemdbbkilneeeh [2023-12-22]
CHR Extension: (Stylish - Custom themes for any website) - C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2023-12-22]
CHR Extension: (Google Документи офлайн) - C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2023-12-22]
CHR Extension: (Screen Capture) - C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghihpjhpgdepnohngpgfcmcijmkggpaf [2023-12-22]
CHR Extension: (AdBlock - Най-добрия в блокирането на реклами) - C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2023-12-22]
CHR Extension: (АБВ Уведомител) - C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default\Extensions\glkfpmcniebkbeakjdpobddpjghbapec [2023-12-22]
CHR Extension: (Skype) - C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2023-12-22]
CHR Extension: (Facebook Screen Sharing) - C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default\Extensions\ncfpggehkhmjpdjpefomjchjafhmbnai [2023-12-22]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\VLADO\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2023-12-22]
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc. -> Riverbed Technology, Inc.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [534592 2023-12-05] (Microsoft Windows Publisher -> Microsoft Corporation)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23110.3-0\NisSrv.exe [3174840 2023-12-06] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23110.3-0\MsMpEng.exe [133592 2023-12-06] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 int0800; C:\Windows\System32\drivers\flashud.sys [51712 2009-09-09] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc. -> Riverbed Technology, Inc.)
S3 nuviocir; C:\Windows\System32\drivers\nuviocir_x64.sys [40464 2015-05-07] (Microsoft Windows Hardware Compatibility Publisher -> Nuvoton Technology Corp.)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] (Empty Loop -> )
S0 WdBoot; C:\Windows\System32\drivers\wd\WdBoot.sys [55856 2023-12-06] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\wd\WdFilter.sys [594304 2023-12-06] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\drivers\wd\WdNisDrv.sys [105856 2023-12-06] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2024-01-02 15:18 - 2024-01-02 15:18 - 000000008 _____ C:\ProgramData\ntuser.pol
2024-01-02 15:17 - 2024-01-02 15:56 - 000001511 _____ C:\Users\VLADO\Desktop\Fixlog.txt
2024-01-02 13:40 - 2024-01-02 16:12 - 000010565 _____ C:\Users\VLADO\Desktop\FRST.txt
2024-01-02 13:40 - 2024-01-02 16:11 - 000000000 ____D C:\FRST
2024-01-02 13:39 - 2024-01-02 13:39 - 002387456 _____ (Farbar) C:\Users\VLADO\Desktop\FRST64.exe
2024-01-02 11:38 - 2024-01-02 11:39 - 000000004 ____H C:\ProgramData\rc76.dat
2024-01-02 11:20 - 2024-01-02 11:20 - 000000128 ____H C:\ProgramData\resource.dat
2024-01-02 11:20 - 2024-01-02 11:20 - 000000008 ____H C:\ProgramData\ts76.dat
2024-01-02 11:19 - 2024-01-02 11:40 - 000000000 ____D C:\ProgramData\XBoxframestore
2024-01-02 11:19 - 2024-01-02 11:19 - 000000000 ____D C:\Users\VLADO\AppData\Local\CrashDumps
2024-01-02 11:18 - 2024-01-02 11:19 - 000000000 ____D C:\Users\VLADO\Documents\GuardFox
2023-12-22 08:24 - 2023-12-22 08:24 - 000000000 ____D C:\Users\VLADO\AppData\Local\Google

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2024-01-02 16:06 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\SystemTemp
2024-01-02 16:01 - 2023-11-15 19:02 - 000851008 _____ C:\Windows\system32\PerfStringBackup.INI
2024-01-02 16:01 - 2023-11-15 18:46 - 000000000 ____D C:\Windows\INF
2024-01-02 15:56 - 2023-11-15 18:58 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2024-01-02 15:56 - 2023-11-15 18:47 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2024-01-02 15:56 - 2023-11-15 18:42 - 000262144 _____ C:\Windows\system32\config\BBI
2024-01-02 15:56 - 2023-06-06 17:51 - 000012288 ___SH C:\DumpStack.log.tmp
2024-01-02 15:17 - 2023-11-15 18:47 - 000000000 ___HD C:\Windows\system32\GroupPolicy
2024-01-02 15:03 - 2023-11-15 18:54 - 000000000 ____D C:\Windows\system32\SleepStudy
2024-01-02 11:18 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\system32\AppLocker
2023-12-29 23:10 - 2023-11-15 18:47 - 000000000 ___HD C:\Program Files\WindowsApps
2023-12-29 23:10 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\AppReadiness
2023-12-27 22:20 - 2023-11-17 15:17 - 000000000 ____D C:\Users\VLADO\AppData\Roaming\uTorrent
2023-12-17 18:06 - 2023-11-15 18:42 - 000032768 _____ C:\Windows\system32\config\ELAM
2023-12-17 18:02 - 2023-11-15 18:47 - 000000000 ___HD C:\Windows\ELAMBKUP
2023-12-16 16:16 - 2023-11-15 19:05 - 000003592 _____ C:\Windows\system32\Tasks\OneDrive Reporting Task-S-1-5-21-1171116283-1440808761-3296070194-1001
2023-12-16 16:16 - 2023-11-15 19:05 - 000003380 _____ C:\Windows\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1171116283-1440808761-3296070194-1001
2023-12-16 16:16 - 2023-11-15 19:05 - 000002411 _____ C:\Users\VLADO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2023-12-13 18:33 - 2023-11-15 19:03 - 000000000 ____D C:\Users\VLADO\AppData\Local\Packages
2023-12-12 21:52 - 2023-11-15 18:47 - 000000000 ____D C:\ProgramData\USOPrivate
2023-12-12 21:36 - 2023-11-15 18:54 - 000296192 _____ C:\Windows\system32\FNTCACHE.DAT
2023-12-12 21:35 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\system32\Microsoft-Edge-WebView
2023-12-12 21:35 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\bcastdvr
2023-12-12 21:32 - 2023-11-15 18:43 - 000000000 ____D C:\Windows\CbsTemp
2023-12-09 21:43 - 2023-06-09 20:56 - 000000000 __SHD C:\Users\VLADO\IntelGraphicsProfiles
2023-12-06 17:59 - 2023-11-15 18:58 - 000000000 ____D C:\Windows\system32\Drivers\wd
2023-12-05 04:45 - 2023-11-15 19:17 - 000000000 ____D C:\Users\VLADO\AppData\Local\D3DSCache
2023-12-05 04:41 - 2023-11-15 18:47 - 000000000 ___RD C:\Windows\ImmersiveControlPanel
2023-12-05 04:41 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\UUS
2023-12-05 04:41 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\SysWOW64\WinMetadata
2023-12-05 04:41 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\SysWOW64\Dism
2023-12-05 04:41 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\SystemResources
2023-12-05 04:41 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\system32\WinMetadata
2023-12-05 04:41 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\system32\oobe
2023-12-05 04:41 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\system32\HealthAttestationClient
2023-12-05 04:41 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\system32\Dism
2023-12-05 04:41 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\system32\appraiser
2023-12-05 04:41 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\ShellExperiences
2023-12-05 04:41 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\ShellComponents
2023-12-05 04:41 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\PolicyDefinitions
2023-12-05 04:41 - 2023-11-15 18:47 - 000000000 ____D C:\Windows\InboxApps
2023-12-05 04:41 - 2023-11-15 18:47 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2023-12-05 04:41 - 2023-11-15 18:42 - 000000000 ____D C:\Windows\servicing

==================== Files in the root of some directories ========

2024-01-02 11:38 - 2024-01-02 11:39 - 000000004 ____H () C:\ProgramData\rc76.dat
2024-01-02 11:20 - 2024-01-02 11:20 - 000000128 ____H () C:\ProgramData\resource.dat
2024-01-02 11:20 - 2024-01-02 11:20 - 000000008 ____H () C:\ProgramData\ts76.dat
2023-11-15 20:48 - 2023-11-15 20:48 - 000000003 _____ () C:\Users\VLADO\AppData\Local\updater.log
2023-11-15 20:48 - 2023-11-19 18:31 - 000000424 _____ () C:\Users\VLADO\AppData\Local\UserProducts.xml

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================

 

Цитат

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01.01.2024
Ran by VLADO (02-01-2024 16:13:12)
Running from C:\Users\VLADO\Desktop
Microsoft Windows 11 Enterprise Version 23H2 22631.2861 (X64) (2023-11-15 17:02:55)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

(If an entry is included in the fixlist, it will be removed.)

Administrator (S-1-5-21-1171116283-1440808761-3296070194-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1171116283-1440808761-3296070194-503 - Limited - Disabled)
Guest (S-1-5-21-1171116283-1440808761-3296070194-501 - Limited - Disabled)
VLADO (S-1-5-21-1171116283-1440808761-3296070194-1001 - Administrator - Enabled) => C:\Users\VLADO
WDAGUtilityAccount (S-1-5-21-1171116283-1440808761-3296070194-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-1171116283-1440808761-3296070194-1001\...\uTorrent) (Version: 3.6.0.46984 - BitTorrent Inc.)
GOM Player (HKLM-x32\...\GOM Player) (Version: 2.2.62.5207 - Gretech Corporation)
Lightshot-5.5.0.7 (HKLM-x32\...\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1) (Version: 5.5.0.7 - Skillbrains)
Microsoft OneDrive (HKU\S-1-5-21-1171116283-1440808761-3296070194-1001\...\OneDriveSetup.exe) (Version: 23.246.1127.0002 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{C6FD611E-7EFE-488C-A0E0-974C09EF6473}) (Version: 5.72.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.31.31103 (HKLM-x32\...\{41d7b770-418a-43b7-95a5-f925fff05789}) (Version: 14.31.31103.0 - Microsoft Corporation)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.31.31103 (HKLM-x32\...\{5720EC03-F26F-40B7-980C-50B5D420B5DE}) (Version: 14.31.31103 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.31.31103 (HKLM-x32\...\{799E3FFF-705C-461F-B400-6DE27398B3E5}) (Version: 14.31.31103 - Microsoft Corporation) Hidden
PicPick (HKLM-x32\...\PicPick) (Version: 7.0.1 - NGWIN)
Revo Uninstaller 2.3.0 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.3.0 - VS Revo Group, Ltd.)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
WinRAR 5.50 (64-битова версия) (HKLM\...\WinRAR archiver) (Version: 5.50.0 - win.rar GmbH)

Packages:
=========
Dev Home (Preview) -> C:\Program Files\WindowsApps\Microsoft.Windows.DevHome_0.801.344.0_x64__8wekyb3d8bbwe [2023-12-15] (Microsoft Corporation)
Microsoft Family -> C:\Program Files\WindowsApps\MicrosoftCorporationII.MicrosoftFamily_0.2.40.0_x64__8wekyb3d8bbwe [2023-11-15] (Microsoft Corp.)
Microsoft.WindowsAppRuntime.CBS -> C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe [2023-12-05] (Microsoft Corporation)
Power Automate -> C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_11.2312.164.0_x64__8wekyb3d8bbwe [2023-12-19] (Microsoft Corporation) [Startup Task]
Solitaire & Casual Games -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.18.11020.0_x64__8wekyb3d8bbwe [2023-11-16] (Microsoft Studios) [MS Ad]
Windows Feature Experience Pack -> C:\Windows\SystemApps\MicrosoftWindows.Client.FileExp_cw5n1h2txyewy [2023-12-05] (Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1171116283-1440808761-3296070194-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\System32\igfxEM.exe (Intel(R) pGFX -> Intel Corporation)
CustomCLSID: HKU\S-1-5-21-1171116283-1440808761-3296070194-1001_Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32 ->  => No File
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2017-08-11] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2017-08-11] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers3: [UnlockerShellExtension] -> {DDE4BEEB-DDE6-48fd-8EB5-035C09923F83} => C:\Program Files\Unlocker\UnlockerCOM.dll [2010-07-15] (Empty Loop -> )
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2016-05-03] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers6: [UnlockerShellExtension] -> {DDE4BEEB-DDE6-48fd-8EB5-035C09923F83} => C:\Program Files\Unlocker\UnlockerCOM.dll [2010-07-15] (Empty Loop -> )
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2017-08-11] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2017-08-11] (win.rar GmbH -> Alexander Roshal)

==================== Codecs (Whitelisted) ====================

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\VLADO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Кошче.lnk -> [LFx@_dP/N1SPSU(Ly9K-e)::{645FF040-5081-101B-9F08-00AA002F954E}] <==== Cyrillic
Shortcut: C:\Users\VLADO\AppData\Roaming\Microsoft\Windows\SendTo\Прехвърляне на файлове с Bluetooth.LNK -> C:\Windows\System32\fsquirt.exe (Microsoft Corporation) <==== Cyrillic
Shortcut: C:\Users\VLADO\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> D:\GoogleChromePortable\App\Chrome-bin\chrome.exe (Google LLC)
ShortcutWithArgument: C:\Users\VLADO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Приложения в Chrome\Google Диск.lnk -> D:\GoogleChromePortable\App\Chrome-bin\chrome_proxy.exe (Google LLC) ->  --profile-directory=Default --app-id=aghbiahbpaijignceidepookljebhfak
ShortcutWithArgument: C:\Users\VLADO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Приложения в Chrome\YouTube.lnk -> D:\GoogleChromePortable\App\Chrome-bin\chrome_proxy.exe (Google LLC) ->  --profile-directory=Default --app-id=agimnkijcaahngcdmfeangaknmldooml
ShortcutWithArgument: C:\Users\VLADO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Приложения в Chrome\Документи.lnk -> D:\GoogleChromePortable\App\Chrome-bin\chrome_proxy.exe (Google LLC) ->  --profile-directory=Default --app-id=mpnpojknpmmopombnjdcgaaiekajbnjb
ShortcutWithArgument: C:\Users\VLADO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Приложения в Chrome\Презентации.lnk -> D:\GoogleChromePortable\App\Chrome-bin\chrome_proxy.exe (Google LLC) ->  --profile-directory=Default --app-id=kefjledonklijopmnomlcbpllchaibag
ShortcutWithArgument: C:\Users\VLADO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Приложения в Chrome\Таблици.lnk -> D:\GoogleChromePortable\App\Chrome-bin\chrome_proxy.exe (Google LLC) ->  --profile-directory=Default --app-id=fhihpiojkbmbpdjeoajapmgkhlnakfjf
ShortcutWithArgument: C:\Users\VLADO\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\2d08cd0531387fbf\Google Chrome.lnk -> D:\GoogleChromePortable\App\Chrome-bin\chrome.exe (Google LLC) -> --profile-directory=Default

==================== Loaded Modules (Whitelisted) =============

==================== Alternate Data Streams (Whitelisted) ========

==================== Safe Mode (Whitelisted) ==================

==================== Association (Whitelisted) =================

==================== Internet Explorer (Whitelisted) ==========

==================== Hosts content: =========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2023-11-15 18:47 - 2023-11-15 18:45 - 000000824 _____ C:\Windows\system32\drivers\etc\hosts

==================== Other Areas ===========================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1171116283-1440808761-3296070194-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\VLADO\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 212.39.90.52 - 212.39.90.53
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(If an entry is included in the fixlist, it will be removed.)

HKLM\...\StartupApproved\Run: => "SecurityHealth"
HKLM\...\StartupApproved\Run32: => "Lightshot"
HKU\S-1-5-21-1171116283-1440808761-3296070194-1001\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_05FEB1AA5A7768C1F24A191C136D8D2C"
HKU\S-1-5-21-1171116283-1440808761-3296070194-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-1171116283-1440808761-3296070194-1001\...\StartupApproved\Run: => "PicPick Start"

==================== FirewallRules (Whitelisted) ================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{A54AF79B-2000-43FE-A562-E0FAD5A5320A}] => (Allow) C:\Program Files\WindowsApps\microsoftteams_23091.406.2009.3890_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{286EC11B-FBF0-41C0-9B78-22D489089382}] => (Allow) C:\Program Files\WindowsApps\microsoftteams_23091.406.2009.3890_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [TCP Query User{A26F96E0-175C-460F-B8C9-7A05DB84342C}D:\googlechromeportable\app\chrome-bin\chrome.exe] => (Allow) D:\googlechromeportable\app\chrome-bin\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [UDP Query User{EAB1CBF2-F369-40F4-9870-9DD7C145773D}D:\googlechromeportable\app\chrome-bin\chrome.exe] => (Allow) D:\googlechromeportable\app\chrome-bin\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{85A3C33A-3B91-4EFE-9994-30530C81DA5A}] => (Allow) C:\Users\VLADO\AppData\Roaming\uTorrent\uTorrent.exe (Rainberry Inc -> BitTorrent Inc.)
FirewallRules: [{3DB8986D-9F5D-4AA0-8DD2-7141B62327A1}] => (Allow) C:\Users\VLADO\AppData\Roaming\uTorrent\uTorrent.exe (Rainberry Inc -> BitTorrent Inc.)

==================== Restore Points =========================

==================== Faulty Device Manager Devices ============

==================== Event log errors: ========================

Application errors:
==================
Error: (01/02/2024 03:56:48 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
hr=0x8007007B
Command-line arguments:
RuleId=502ff3ba-669a-4674-bbb1-601f34a3b968;Action=AutoActivateSilent;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=73111121-5638-40f6-bc11-f1d7b0d64300;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (01/02/2024 03:56:45 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
hr=0x8007007B
Command-line arguments:
RuleId=502ff3ba-669a-4674-bbb1-601f34a3b968;Action=AutoActivateSilent;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=73111121-5638-40f6-bc11-f1d7b0d64300;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (01/02/2024 03:56:40 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
hr=0x8007007B
Command-line arguments:
RuleId=502ff3ba-669a-4674-bbb1-601f34a3b968;Action=AutoActivateSilent;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=73111121-5638-40f6-bc11-f1d7b0d64300;NotificationInterval=1440;Trigger=UserLogon;SessionId=1

Error: (01/02/2024 03:18:57 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
hr=0x8007007B
Command-line arguments:
RuleId=502ff3ba-669a-4674-bbb1-601f34a3b968;Action=AutoActivateSilent;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=73111121-5638-40f6-bc11-f1d7b0d64300;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (01/02/2024 03:18:55 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
hr=0x8007007B
Command-line arguments:
RuleId=502ff3ba-669a-4674-bbb1-601f34a3b968;Action=AutoActivateSilent;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=73111121-5638-40f6-bc11-f1d7b0d64300;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (01/02/2024 03:18:53 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
hr=0x8007007B
Command-line arguments:
RuleId=502ff3ba-669a-4674-bbb1-601f34a3b968;Action=AutoActivateSilent;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=73111121-5638-40f6-bc11-f1d7b0d64300;NotificationInterval=1440;Trigger=UserLogon;SessionId=1

Error: (01/02/2024 03:17:37 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW.  hr = 0x8007001f, A device attached to the system is not functioning..

Operation:
   Executing Asynchronous Operation

Context:
   Current State: DoSnapshotSet

Error: (01/02/2024 03:17:24 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied..This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {7738005e-d09e-4534-8cdb-c5aa5e0997ca}

System errors:
=============
Error: (01/02/2024 03:55:55 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Услуга Microsoft Update Health Service беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

Error: (01/02/2024 03:17:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Услуга Microsoft Update Health Service беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

Error: (01/02/2024 08:32:17 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-7G3RDAC)
Description: The server {8CFC164F-4BE5-4FDD-94E9-E2AF73ED4A19} did not register with DCOM within the required timeout.

Error: (01/01/2024 09:25:04 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-7G3RDAC)
Description: The server {8CFC164F-4BE5-4FDD-94E9-E2AF73ED4A19} did not register with DCOM within the required timeout.

Error: (12/31/2023 08:09:05 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-7G3RDAC)
Description: The server {8CFC164F-4BE5-4FDD-94E9-E2AF73ED4A19} did not register with DCOM within the required timeout.

Error: (12/30/2023 08:27:33 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-7G3RDAC)
Description: The server {8CFC164F-4BE5-4FDD-94E9-E2AF73ED4A19} did not register with DCOM within the required timeout.

Error: (12/29/2023 03:45:36 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-7G3RDAC)
Description: The server {8CFC164F-4BE5-4FDD-94E9-E2AF73ED4A19} did not register with DCOM within the required timeout.

Error: (12/28/2023 10:59:04 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-7G3RDAC)
Description: The server {8CFC164F-4BE5-4FDD-94E9-E2AF73ED4A19} did not register with DCOM within the required timeout.

Windows Defender:
================
Date: 2024-01-02 12:03:37
Description: 
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/SExec.SB!tsk&threatid=2147898402&enterprise=0
Name: Trojan:Win32/SExec.SB!tsk
Severity: Много високо
Category: Троянски кон
Path: containerfile:_C:\Windows\System32\Tasks\Time Trigger Task; file:_C:\Windows\System32\Tasks\Time Trigger Task->(UTF-16LE); regkey:_HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D69C552B-6C8A-4EF1-93CF-B919CE290872}; regkey:_HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Time Trigger Task; taskscheduler:_C:\Windows\System32\Tasks\Time Trigger Task
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: User
Process Name: Unknown
Security intelligence Version: AV: 1.403.1516.0, AS: 1.403.1516.0, NIS: 0.0.0.0
Engine Version: AM: 1.1.23110.2, NIS: 0.0.0.0 

Date: 2024-01-02 11:44:07
Description: 
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:Win32/DefenderTamperingRestore&threatid=2147741622&enterprise=0
Name: VirTool:Win32/DefenderTamperingRestore
Severity: Много високо
Category: Инструмент
Path: regkeyvalue:_hklm\software\policies\microsoft\windows defender\real-time protection\\DisableBehaviorMonitoring
Detection Origin: Unknown
Detection Type: Concrete
Detection Source: System
Process Name: Unknown
Security intelligence Version: AV: 1.403.1516.0, AS: 1.403.1516.0, NIS: 0.0.0.0
Engine Version: AM: 1.1.23110.2, NIS: 0.0.0.0 

Date: 2024-01-01 18:40:52
Description: 
Microsoft Defender Antivirus scan has been stopped before completion.
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2023-12-31 18:25:17
Description: 
Microsoft Defender Antivirus scan has been stopped before completion.
Scan Type: Antimalware
Scan Parameters: Quick Scan

Date: 2023-12-30 18:39:43
Description: 
Microsoft Defender Antivirus scan has been stopped before completion.
Scan Type: Antimalware
Scan Parameters: Quick Scan

CodeIntegrity:
===============
Date: 2023-12-17 18:02:28
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.18.23110.3-0\MpCmdRun.exe) attempted to load \Device\HarddiskVolume2\Program Files\Avast Software\Avast\aswAMSI.dll that did not meet the Microsoft signing level requirements. 

==================== Memory info =========================== 

BIOS: American Megatrends Inc. P2.00 07/11/2012
Motherboard: ASRock H61M-GE
Processor: Intel(R) Core(TM) i5-3470S CPU @ 2.90GHz
Percentage of memory in use: 23%
Total physical RAM: 11993.06 MB
Available physical RAM: 9168.71 MB
Total Virtual: 12761.06 MB
Available Virtual: 10197.23 MB

==================== Drives ================================

Drive 😄 () (Fixed) (Total:60.9 GB) (Free:34.99 GB) (Model: BIOSTAR S100-120GB ATA Device) NTFS ==>[system with boot components (obtained from drive)]
Drive d: () (Fixed) (Total:931.51 GB) (Free:849.22 GB) (Model: WDC WD10JPCX-24UE4T0 ATA Device) NTFS
Drive f: () (Fixed) (Total:49.44 GB) (Free:21.94 GB) (Model: BIOSTAR S100-120GB ATA Device) NTFS ==>[system with boot components (obtained from drive)]

\\?\Volume{9af21463-0000-0000-0000-30961b000000}\ () (Fixed) (Total:0.76 GB) (Free:0.08 GB) NTFS
\\?\Volume{9af21463-0000-0000-0000-20c71b000000}\ () (Fixed) (Total:0.68 GB) (Free:0.08 GB) NTFS

==================== MBR & Partition Table ====================

==========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 111.8 GB) (Disk ID: 9AF21463)
Partition 1: (Active) - (Size=49.4 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=60.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=782 MB) - (Type=27)
Partition 4: (Not Active) - (Size=693 MB) - (Type=27)

==========================================================
Disk: 1 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: D9FA2484)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=42)

==================== End of Addition.txt =======================

 

Дневниците са чисти ..няма индикации за зловреден софтуер...Колкото до Фейсбук при вашия вариант с откраднати имейл и парола доколкото си спомням трябваше да се докладва през този формуляр.

или използвайте следната връзка:

Hacked and Fake Accounts | Facebook Help Center

 

...а за да премахнем FRST и  всички негови файлове, моля, направете следното:

KpRm 
 
Изтеглете  KpRm от kernel-panik и го запишете на вашия работен плот. 

• Щракнете с десния бутон върху kprm_ (версия) .exe и изберете Изпълни като администратор. 
• Когато инструментът се отвори, уверете се, че всички квадратчета са отметнати и изберете Изпълни ( Run ).

• След като приключите, щракнете върху OK. 
• В Notepad ще се отвори журнал, озаглавен kprm- (date) .txt. 
• Моля, копирайте и поставете съдържанието му в следващия си отговор.

Благодаря много за помоща и за отделеното време.

Цитат

# Run at 2.1.2024 'г.' 16:50:32
# KpRm (Kernel-panik) version 2.15.0
# Website https://kernel-panik.me/tool/kprm/
# Run by VLADO from C:\Users\VLADO\Desktop
# Computer Name: DESKTOP-7G3RDAC
# OS: Windows 11 X64 (22631) (10.0.22631.2861) 
# Number of passes: 1

- Checked options -

    ~ Registry Backup
    ~ Delete Tools
    ~ Restore System Settings
    ~ UAC Restore
    ~ Delete Restore Points
    ~ Create Restore Point
    ~ Delete Quarantines

- Create Registry Backup -

   ~ [OK] Hive C:\Windows\System32\config\SOFTWARE backed up
   ~ [OK] Hive C:\Users\VLADO\NTUSER.dat backed up

     [OK] Registry Backup: C:\KPRM\backup\2024-01-02-16-50-32

- Delete Tools -

  ## FRST
     [OK] C:\Users\VLADO\Desktop\Addition.txt deleted
     [OK] C:\Users\VLADO\Desktop\Fixlog.txt deleted
     [OK] C:\Users\VLADO\Desktop\FRST.txt deleted
     [OK] C:\Users\VLADO\Desktop\FRST64.exe deleted
     [OK] C:\FRST deleted

- Restore System Settings -

     [OK] Reset WinSock
     [OK] FLUSHDNS
     [OK] Hide Hidden file.
     [OK] Show Extensions for known file types
     [OK] Hide protected operating system files

- Restore UAC -

     [OK] Set EnableLUA with default (1) value
     [OK] Set ConsentPromptBehaviorAdmin with default (5) value
     [OK] Set ConsentPromptBehaviorUser with default (3) value
     [OK] Set EnableInstallerDetection with default (0) value
     [OK] Set EnableSecureUIAPaths with default (1) value
     [OK] Set EnableUIADesktopToggle with default (0) value
     [OK] Set EnableVirtualization with default (1) value
     [OK] Set FilterAdministratorToken with default (0) value
     [OK] Set PromptOnSecureDesktop with default (1) value
     [OK] Set ValidateAdminCodeSignatures with default (0) value

- Clear Restore Points -

     [I] No system recovery points were found

- Create Restore Point -

     [OK] System Restore Point created

- Display System Restore Point -

   ~ [I] RP named KpRm created at 01/02/2024 14:50:44

-- KPRM finished in 24.73s --

 

преди 4 минути, vlado1985 написа:

Благодаря много за помоща и за отделеното време.

 

..и аз благодаря за коректната работа..!  Бъдете здрав и безопасно сърфиране ..!