Образ автозапуска
Код |
---|
;uVS v4.11 [http://dsrt.dyndns.org:8888] ;Target OS: NTv6.1 v400c OFFSGNSAVE zoo %SystemDrive%\USERS\HOME\APPDATA\ROAMING\MICROSOFT\ADMODNETW4B8\ADNEKMOD8B4.DLL czoo regt 18 regt 25 regt 26 regt 38 deltmp restart ;---------command-block--------- delall %SystemDrive%\USERS\HOME\APPDATA\ROAMING\MICROSOFT\ADMODNETW4B8\ADNEKMOD8B4.DLL delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DEOFCBNMAJMJMPLFLAPAOJJNIHCJKIGCK%26INSTALLSOURCE%3DONDEMAND%26UC delref %SystemDrive%\USERS\HOME\APPDATA\LOCAL\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\EXTENSIONS\MDPLJNDCMBEIKFNLFLCGGAIPGNHIEDBL\9.27_0\SAVEFROM.NET ПОМОЩНИК delref %SystemDrive%\USERS\HOME\APPDATA\LOCAL\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\EXTENSIONS\NPDPPLBICNMPOIGIDFDJADAMGFKILAAK\9.27_0\SAVEFROM.NET ПОМОЩНИК delref $E082E,3766895,54272,C:\USERS\HOME\DOWNLOADS\TUNNGLE_SETUP_V4.5.1.4B.EXE delref G:\ADWCLEANER_8.0.0.EXE delref %SystemDrive%\PROGRAM FILES\AVAST SOFTWARE\AVAST\AVEMUPDATE.EXE delref %SystemDrive%\PROGRAM FILES\COMMON FILES\AVAST SOFTWARE\OVERSEER\OVERSEER.EXE delref %SystemDrive%\PROGRAM FILES (X86)\KERISH DOCTOR\KERISHDOCTOR.EXE delref {23E5D772-327A-42F5-BDEE-C65C6796BB2A}\[CLSID] delref {177AFECE-9599-46CF-90D7-68EC9EEB27B4}\[CLSID] delref {CEF51277-5358-477B-858C-4E14F0C80BF7}\[CLSID] delref {59116E30-02BD-4B84-BA1E-5D77E809B1A2}\[CLSID] delref %SystemDrive%\PROGRAM FILES (X86)\BLUESTACKS\HD-RUNTIMEUNINSTALLER.EXE delref %SystemRoot%\SYSWOW64\TBSSVC.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\NDIS.SYS delref %SystemRoot%\SYSWOW64\UMPO.DLL delref %SystemRoot%\SYSWOW64\IPHLPSVC.DLL delref %SystemRoot%\SYSWOW64\PNRPSVC.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\PACER.SYS delref %SystemRoot%\SYSWOW64\LSM.EXE delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID] delref {CA8A9780-280D-11CF-A24D-444553540000}\[CLSID] delref {D27CDB6E-AE6D-11CF-96B8-444553540000}\[CLSID] delref %SystemRoot%\SYSWOW64\WIN32K.SYS delref {E0DD6CAB-2D10-11D2-8F1A-0000F87ABD16}\[CLSID] delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\57.0.2987.133\INSTALLER\CHRMSTP.EXE delref %SystemRoot%\SYSWOW64\BLANK.HTM delref SLDWORKS SHELL EXTENSION\[CLSID] delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID] delref {474C98EE-CF3D-41F5-80E3-4AAB0AB04301}\[CLSID] delref {7EFA68C6-086B-43E1-A2D2-55A113531240}\[CLSID] delref D:\ delref %Sys32%\MSSPELLCHECKINGFACILITY.DLL delref %Sys32%\BLANK.HTM delref %SystemDrive%\PROGRAM FILES\AMD\CNEXT\CNEXT\ATIACM64.DLL delref {472083B0-C522-11CF-8763-00608CC02F24}\[CLSID] delref APPMGMT\[SERVICE] delref HELPSVC\[SERVICE] delref SACSVR\[SERVICE] delref VMMS\[SERVICE] delref MESSENGER\[SERVICE] delref RDSESSMGR\[SERVICE] delref %Sys32%\DRIVERS\ADGNETWORKTDI.SYS delref %Sys32%\DRIVERS\EAGLEX64.SYS delref %Sys32%\PSXSS.EXE delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\EXTENSIONS\{972CE4C6-7E08-4474-A285-3208198CE6FD} delref %SystemDrive%\PROGRAM FILES (X86)\PDF ARCHITECT\FFPDFARCHITECTEXT delref %SystemDrive%\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF delref %SystemDrive%\USERS\ДИМА\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NAHD6HA2.DEFAULT\EXTENSIONS\{6221D3F4-D69D-46E5-B989-B5FDE79C2247}.XPI delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\FEATURES\[email protected] delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\FEATURES\[email protected] delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\FEATURES\[email protected] delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\EXTENSIONS\{972CE4C6-7E08-4474-A285-3208198CE6FD}.XPI delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\GOOGLE.XML delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\MAILRU.XML delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\OZONRU.XML delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\PRICERU.XML delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\WIKIPEDIA-RU.XML delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\YANDEX-SLOVARI.XML delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\YANDEX.XML delref %SystemDrive%\PROGRAM FILES\AUTODESK\3DS MAX 2020\INVENTOR SERVER\BIN\TESTSERVER.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.26.9\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\BLUESTACKS\BSTKSVC.EXE delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDMFTDECODER_64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.23\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDHWDECODER_64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.1\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.442\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.32\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES\COMMON FILES\SOLIDWORKS SHARED\SLDSHELLUTILS10U.DLL delref %SystemDrive%\PROGRAM FILES (X86)\BLUESTACKS\BSTKC.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.32.7\PSMACHINE_64.DLL delref D:\ПРОГРАММЫ\SOLIDWORKS 2013 SP3.0\SOLIDWORKS\SCANTO3D\ADDIN\NEMODEL.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.17\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.27.5\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.34.11\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.15\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.1\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.5\PSMACHINE_64.DLL delref D:\ПРОГРАММЫ\SOLIDWORKS 2013 SP3.0\SOLIDWORKS\DSGNCHK\DSGNCHKBLDU.EXE delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.7\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDMFTVIDEODECODER_64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.25.11\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.3\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.452\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDH264ENC64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.13\PSMACHINE_64.DLL delref %Sys32%\SHAREMEDIACPL.CPL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.5\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.31.5\PSMACHINE_64.DLL delref D:\ПРОГРАММЫ\FL STUDIO 12\PLUGINS\FRUITY\EFFECTS\ZGAMEEDITOR VISUALIZER\MEDIAVIDEODECODER_X64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.30.3\PSMACHINE_64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.26.9\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDMFTDECODER_32.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.23\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDHWDECODER_32.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.1\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.442\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.32\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.32.7\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.17\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.27.5\PSMACHINE.DLL delref D:\ПРОГРАММЫ\SOLIDWORKS 2013 SP3.0\SOLIDWORKS\SWVBASERVER\SWVBASERVER.EXE delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.34.11\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.15\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.1\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.5\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.7\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDMFTVIDEODECODER_32.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.25.11\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.3\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.452\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.23\GOOGLEUPDATEBROKER.EXE delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDH264ENC32.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.13\PSMACHINE.DLL delref D:\ПРОГРАММЫ\SOLIDWORKS 2013 SP3.0\SOLIDWORKS\SIMULATION\PARAMETRICOBJECT.EXE delref D:\ПРОГРАММЫ\SOLIDWORKS 2013 SP3.0\SOLIDWORKS EDRAWINGS\EDRAWINGOFFICEAUTOMATOR.EXE delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.5\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.31.5\PSMACHINE.DLL delref D:\ПРОГРАММЫ\FL STUDIO 12\PLUGINS\FRUITY\EFFECTS\ZGAMEEDITOR VISUALIZER\MEDIAVIDEODECODER.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.30.3\PSMACHINE.DLL delref G:\HISUITEDOWNLOADER.EXE delref E:\AUTOPLAY.EXE delref G:\AUTORUN.EXE delref H:\HISUITEDOWNLOADER.EXE delref {7AEFE841-DCA1-4A95-80CB-BE935D020400}\[CLSID] delref {92780B25-18CC-41C8-B9BE-3C9C571A8263}\[CLSID] delref D:\ПРОГРАММЫ\FL STUDIO 12\FL64.EXE delref D:\1GAMES\BEAMNG.DRIVE 0.4.0.2\BEAMNG.DRIVE.EXE delref D:\1GAMES\BEAMNG.DRIVE\UNINS000.EXE delref D:\ПРОГРАММЫ\FL STUDIO 12\FL.EXE delref %SystemDrive%\PROGRAM FILES (X86)\RAIDCALL\RAIDCALL.EXE delref %SystemDrive%\PROGRAM FILES (X86)\RAIDCALL\UNINST.EXE delref D:\1GAMES\RIMWORLD\RIMWORLD914WIN.EXE delref D:\1GAMES\THE BINDING OF ISAAC - AFTERBIRTH\ISAAC-NG.EXE delref D:\1GAMES\THE BINDING OF ISAAC - AFTERBIRTH\UNINS000.EXE apply |
Код |
---|
AlternateDataStreams: C:\ProgramData\TEMP:A1EDB939 [132] AlternateDataStreams: C:\Users\Все пользователи\TEMP:A1EDB939 [132] HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION HKU\S-1-5-21-4157911900-1696094767-1380536065-1000\...\Run: [Clownfish] => [X] HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION Task: {3D7A54BA-ABC7-4031-8BCE-3BD9B29E6838} - \{BF7EEC91-39C5-4DF6-8A89-7EDA2D253C10} -> No File <==== ATTENTION Task: {3FC2EEB5-BB53-4324-A3D6-39D90B84B0B2} - no filepath Task: {60AF8528-98CF-4128-BECB-A884970D14BF} - \SidebarExecute -> No File <==== ATTENTION Task: {64A2575B-B075-44F0-AEDD-4FE6B438568C} - \Microsoft\Windows\Media Center\PvrScheduleTask -> No File <==== ATTENTION Task: {7E08025A-B290-4423-A1F4-84517F8CDC47} - \Microsoft\Windows\Media Center\SqlLiteRecoveryTask -> No File <==== ATTENTION Task: {907E4247-2645-4887-B620-536B5023DEDA} - \Kerish Doctor -> No File <==== ATTENTION Task: {938F943C-D047-430D-B86E-E5254CC69F38} - \zAmigoBrowserUpdate -> No File <==== ATTENTION Task: {C3DF0C0C-9DB0-4828-896E-55FCA1454970} - \Microsoft\Windows\Media Center\ObjectStoreRecoveryTask -> No File <==== ATTENTION Task: {EE9582F1-97E6-49E4-8FD3-8BF1B8F4DBD8} - no filepath Task: {FC2EE9C7-FDF8-4217-9D9E-BED1154E032F} - \Microsoft\Windows\Media Center\MediaCenterRecoveryTask -> No File <==== ATTENTION FF Plugin-x32: @adobe.com/AuthorwarePlayer -> C:\Windows\system32\Macromed\AUTHORWA\np32asw.dll [No File] FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll [No File] EmptyTemp: Reboot: |
Цитата |
---|
Андрей Евдокимов написал: Нод периодически ругается на msil/coinminer.bgj и требует перезапуск компьютера. Если не реагировать на оповещение о перезапуске, процессор нагружается на 100%. ГПУ майнер не трогает. Подскажите, пожалуйста, как от него избавиться( |
Цитата |
---|
Полное имя C:\USERS\***\APPDATA\ROAMING\MICROSOFT\ADMODNETW4B8\ADNEKMOD8B4.DLL Имя файла ADNEKMOD8B4.DLL Тек. статус ВИРУС в автозапуске Обнаруженные сигнатуры Сигнатура MSIL/Agent.UFA [ESET-NOD32] (delall) [глубина совпадения 64(64), необх. минимум 64, максимум 64] 2020-12-25 Сохраненная информация на момент создания образа Статус в автозапуске File_Id 5FDC35A8C000 Linker 11.0 Размер 12800 байт Создан 23.12.2020 в 16:02:50 Изменен 23.12.2020 в 16:02:50 TimeStamp 18.12.2020 в 04:52:56 EntryPoint + OS Version 0.0 Subsystem Windows character-mode user interface (CUI) subsystem IMAGE_FILE_DLL + IMAGE_FILE_EXECUTABLE_IMAGE + Тип файла 64-х битный ИСПОЛНЯЕМЫЙ Цифр. подпись Отсутствует либо ее не удалось проверить Оригинальное имя AdNetwork.dll Версия файла 1.0.0.0 Описание AdNetwork Производитель Комментарий Доп. информация на момент обновления списка Файл C:\WINDOWS\SYSTEM32\RUNDLL32.EXE CmdLine C:\USERS\***\APPDATA\ROAMING\MICROSOFT\ADMODNETW4B8\ADNEKMOD8B4.DLL,AMIGOUPDATER SHA1 0CBA96ADD40FC610017EF4A2BA8F4220694A1018 MD5 B5BF285378916D5119D87C08917FE872 Ссылки на объект Ссылка C:\WINDOWS\SYSTEM32\TASKS\ZAMIGOBROWSERUPDATE Prefetcher C:\WINDOWS\Prefetch\Layout.ini |