script ver. 2024.01.08
File name: AVbr.exe
Start-up time: 2024.02.08-21:31:09
Launched from: C:\Users\Admond\Downloads\AV_block_remover\
System: x64 Windows 10 Pro
Build number: 19045
AVBr has been run with local Administrator rights.
Elevation of privileges of rights is successful.
System booted up in Normal Mode.
Last update was on: 2024.02.08
Current date is: 2024.02.08
Current version is: 2024.02.08
Script running will be continued after 20 seconds.
C:\ProgramData\Microsoft\Check\ - Exists
C:\ProgramData\Microsoft\Intel\ - Exists
C:\ProgramData\Microsoft\temp\ - Exists
C:\ProgramData\System32\ - Exists
C:\ProgramData\microsoft\clr_optimization_v4.0.30318_64\ - Exists
C:\Program Files\Internet Explorer\bin\ - Exists
C:\Windows\Fonts\Mysql\ - Exists
C:\Windows\speechstracing\ - Exists
C:\ProgramData\Malwarebytes\ - Exists
Run an application takeown.exe /f "C:\ProgramData\Malwarebytes" /A /r /d y
Exit code = 0
Run an application icacls.exe "C:\ProgramData\Malwarebytes" /reset /C /L
Exit code = 0
Run an application icacls.exe "C:\ProgramData\Malwarebytes" /grant *S-1-5-32-545:RX /C /L /inheritance:r
Exit code = 0
Run an application icacls.exe "C:\ProgramData\Malwarebytes" /grant *S-1-5-32-544:(OI)(CI)F /C /L
Exit code = 0
Run an application icacls.exe "C:\ProgramData\Malwarebytes" /grant *S-1-5-18:(OI)(CI)F /C /L
Exit code = 0
Run an application icacls.exe "C:\ProgramData\Malwarebytes" /grant *S-1-5-11:(OI)(CI)F /C /L
Exit code = 0
Run an application icacls.exe "C:\ProgramData\Malwarebytes\*" /reset /T /C /L
Exit code = 0
C:\Program Files\CPUID\HWMonitor\ - Exists
C:\Program Files\Google\Chrome\ - Exists
Run an application takeown.exe /f "C:\Program Files\Google\Chrome" /A /r /d y
Exit code = 0
Run an application icacls.exe "C:\Program Files\Google\Chrome" /reset /C /L
Exit code = 0
Run an application icacls.exe "C:\Program Files\Google\Chrome" /grant *S-1-5-32-545:RX /C /L /inheritance:r
Exit code = 0
Run an application icacls.exe "C:\Program Files\Google\Chrome" /grant *S-1-5-32-544:(OI)(CI)F /C /L
Exit code = 0
Run an application icacls.exe "C:\Program Files\Google\Chrome" /grant *S-1-5-18:(OI)(CI)F /C /L
Exit code = 0
Run an application icacls.exe "C:\Program Files\Google\Chrome" /grant *S-1-5-11:(OI)(CI)F /C /L
Exit code = 0
Run an application icacls.exe "C:\Program Files\Google\Chrome" /grant *S-1-15-2-1:(OI)(CI)RX /C /L
Exit code = 0
Run an application icacls.exe "C:\Program Files\Google\Chrome" /grant *S-1-15-2-2:(OI)(CI)RX /C /L
Exit code = 0
Run an application icacls.exe "C:\Program Files\Google\Chrome\*" /reset /T /C /L
Exit code = 0
C:\Program Files\Malwarebytes\ - Exists
Run an application takeown.exe /f "C:\Program Files\Malwarebytes" /A /r /d y
Exit code = 0
Run an application icacls.exe "C:\Program Files\Malwarebytes" /reset /C /L
Exit code = 0
Run an application icacls.exe "C:\Program Files\Malwarebytes" /grant *S-1-5-32-545:RX /C /L /inheritance:r
Exit code = 0
Run an application icacls.exe "C:\Program Files\Malwarebytes" /grant *S-1-5-32-544:(OI)(CI)F /C /L
Exit code = 0
Run an application icacls.exe "C:\Program Files\Malwarebytes" /grant *S-1-5-18:(OI)(CI)F /C /L
Exit code = 0
Run an application icacls.exe "C:\Program Files\Malwarebytes" /grant *S-1-5-11:(OI)(CI)F /C /L
Exit code = 0
Run an application icacls.exe "C:\Program Files\Malwarebytes" /grant *S-1-15-2-1:(OI)(CI)RX /C /L
Exit code = 0
Run an application icacls.exe "C:\Program Files\Malwarebytes" /grant *S-1-15-2-2:(OI)(CI)RX /C /L
Exit code = 0
Run an application icacls.exe "C:\Program Files\Malwarebytes\*" /reset /T /C /L
Exit code = 0
C:\Program Files (x86)\MSI\MSI Center\ - Exists
C:\FRST\ - Exists
Run an application takeown.exe /f "C:\FRST" /A /r /d y
Exit code = 0
Run an application icacls.exe "C:\FRST" /reset /C /L
Exit code = 0
Run an application icacls.exe "C:\FRST" /grant *S-1-5-32-545:RX /C /L /inheritance:r
Exit code = 0
Run an application icacls.exe "C:\FRST" /grant *S-1-5-32-544:(OI)(CI)F /C /L
Exit code = 0
Run an application icacls.exe "C:\FRST" /grant *S-1-5-18:(OI)(CI)F /C /L
Exit code = 0
Run an application icacls.exe "C:\FRST" /grant *S-1-5-11:(OI)(CI)F /C /L
Exit code = 0
Run an application icacls.exe "C:\FRST\*" /reset /T /C /L
Exit code = 0
C:\Users\Admond\Downloads\AV_block_remover\ - Exists
Exit code = 0
Run an application icacls.exe "C:\Users\Admond\Downloads\AV_block_remover" /grant *S-1-5-32-545:RX /C /L /inheritance:r
Exit code = 0
Run an application icacls.exe "C:\Users\Admond\Downloads\AV_block_remover" /grant *S-1-5-18:(OI)(CI)F /C /L
Exit code = 0
Run an application icacls.exe "C:\Users\Admond\Downloads\AV_block_remover" /grant *S-1-5-11:(OI)(CI)F /C /L
Exit code = 0
Run an application icacls.exe "C:\Users\Admond\Downloads\AV_block_remover\*" /reset /T /C /L
Exit code = 0
C:\Program Files\CPUID\ - Exists
C:\Program Files\Google\ - Exists
C:\Program Files (x86)\MSI\ - Exists
Create SWPRV service:
[SC] CreateService: ошибка: 1073:

Указанная служба уже существует.

Exit code = 1073
[SC] ChangeServiceConfig2: успех
Exit code = 0
PowerShellVersion: 5.1.19041.1
Starting the export of Applocker policies.
Exit code = 0

DisableAntiSpyware = 0
DisableAntiVirus = 0
[!] Some of these exclusions were not deleted.
iTamperProtection = 1
Export firewall rules.
ОК.

Exit code = 0
Run an application netsh.exe advfirewall firewall delete rule name=all program="C:\ProgramData\Windows\rutserv.exe"

Ни одно правило не соответствует указанным критериям.

Exit code = 1
Run an application netsh.exe advfirewall firewall delete rule name=all program="C:\ProgramData\Windows Tasks Service\winserv.exe"

Ни одно правило не соответствует указанным критериям.

Exit code = 1
Run an application netsh.exe advfirewall firewall delete rule name=all program="C:\ProgramData\WindowsTask\AppModule.exe"

Ни одно правило не соответствует указанным критериям.

Exit code = 1
Run an application netsh.exe advfirewall firewall delete rule name=all program="C:\ProgramData\WindowsTask\AMD.exe"

Ни одно правило не соответствует указанным критериям.

Exit code = 1
Run an application netsh.exe advfirewall firewall delete rule name="Remote Desktop" protocol=tcp localport=3389

Ни одно правило не соответствует указанным критериям.

Exit code = 1
Run an application netsh.exe advfirewall firewall delete rule name="Port Block" protocol=tcp localport=139

Ни одно правило не соответствует указанным критериям.

Exit code = 1
Run an application netsh.exe advfirewall firewall delete rule name="Port Block" protocol=tcp localport=445

Ни одно правило не соответствует указанным критериям.

Exit code = 1
Run an application netsh.exe advfirewall firewall delete rule name="Port Block" protocol=udp localport=139

Ни одно правило не соответствует указанным критериям.

Exit code = 1
Run an application netsh.exe advfirewall firewall delete rule name="Port Block" protocol=udp localport=445

Ни одно правило не соответствует указанным критериям.

Exit code = 1
Run an application netsh.exe advfirewall firewall delete rule name="Port Blocking" protocol=tcp localport=139

Ни одно правило не соответствует указанным критериям.

Exit code = 1
Run an application netsh.exe advfirewall firewall delete rule name="Port Blocking" protocol=tcp localport=445

Ни одно правило не соответствует указанным критериям.

Exit code = 1
Run an application netsh.exe advfirewall firewall delete rule name="Port Blocking" protocol=udp localport=139

Ни одно правило не соответствует указанным критериям.

Exit code = 1
Run an application netsh.exe advfirewall firewall delete rule name="Port Blocking" protocol=udp localport=445

Ни одно правило не соответствует указанным критериям.

Exit code = 1
Run an application netsh.exe advfirewall firewall delete rule name="allow RDP" protocol=tcp localport=3389

Ни одно правило не соответствует указанным критериям.

Exit code = 1
Hosts file not found. A clean hosts file will be created now.
Registry search of AV blocked signatures.
GRM = 3
Now the computer will be rebooted.
===================================================================================
The following logs were found in folder after previous runs of AVbr:
AV_block_remove_2024.02.08-21.31.log