Start::
StartPowershell:
Remove-MpPreference -ExclusionPath "C:\Users\123\AppData\Local\Browserupdphenix"
Remove-MpPreference -ExclusionPath "C:\Users\123\AppData\Local\ProtectBrowser"
Set-MpPreference -DisableAutoExclusions $true -Force
Set-MpPreference -Mapsreporting basic -Force
Set-MpPreference -DisableRealtimeMonitoring $false -Force
Set-MpPreference -DisablePrivacyMode $true -Force
Set-MpPreference -DisableIOAVProtection $false -Force
Set-MpPreference -UILockdown 0
Set-MpPreference -ScanPurgeItemsAfterDelay 1
Set-MpPreference -CheckForSignaturesBeforeRunningScan $true -Force
Set-MpPreference -PUAProtection enabled -Force
Update-MpSignature
Get-MpComputerStatus
Get-MpPreference
EndPowerShell:
C:\Users\123\AppData\Local\Browserupdphenix
C:\Users\123\AppData\Local\ProtectBrowser
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
Reboot:
End:: 

 Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
Unlock: C:\FRST\
Task: {E1147637-D255-4A89-958B-2D26CE934156} - System32\Tasks\ProtectBrowser => C:\Users\123\AppData\Local\ProtectBrowser\ProtectBrowser.exe [920576 2023-05-21] () [Файл не подписан] -> %LOCALAPPDATA%\ProtectBrowser\E7AC826D875BC50825C8200BAE4ECD51DD342E1EE47437D19359A8919F2AC10608271C2A85719DEAF46633E3B2 omd_t14_8969_E7AC826D875BC50825C8200BAE4ECD51DD342E1EE47437D19359A8919F2AC10608271C2A85719DEAF46633E3B2
HKU\S-1-5-21-693277407-1853974361-4094227332-1001\...\Run: [MediaGet2] => C:\Users\123\MediaGet2\mediaget.exe --minimized (Нет файла)
GroupPolicy: Ограничение - Chrome <==== ВНИМАНИЕ
Policies: C:\ProgramData\NTUSER.pol: Ограничение <==== ВНИМАНИЕ
HKLM\SOFTWARE\Policies\Google: Ограничение <==== ВНИМАНИЕ
Task: {0935860A-3277-4361-BD86-2E0D78B0EDE2} - \Browserupdphenix -> Нет файла <==== ВНИМАНИЕ
C:\Users\123\AppData\Local\ProtectBrowser\
CHR HKU\S-1-5-21-693277407-1853974361-4094227332-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ibknafobnmndicojahlppolcaaibngjf]
R3 cpuz158; C:\Windows\temp\cpuz158\cpuz158_x64.sys [44592 2025-02-15] (Microsoft Windows Hardware Compatibility Publisher -> CPUID) <==== ВНИМАНИЕ
S3 PDFWKRNL; \??\C:\Users\123\AppData\Local\Temp\USBCPDFW\pdfwkrnl.sys [X] <==== ВНИМАНИЕ
CustomCLSID: HKU\S-1-5-21-693277407-1853974361-4094227332-1001_Classes\CLSID\{5C4D8D77-5B87-40CA-884E-F56858227E5C}\localserver32 -> C:\Users\123\AppData\Local\Programs\TeamSpeak\notification_helper.exe => Нет файла
CustomCLSID: HKU\S-1-5-21-693277407-1853974361-4094227332-1001_Classes\CLSID\{28A80003-18FD-411D-B0A3-3C81F618E22B}\InprocServer32 -> C:\Users\123\AppData\Local\Kingsoft\WPS Office\12.2.0.17545\office6\kwpsmenushellext64.dll => Нет файла
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [6162]
startbatch:
del /s /q "%userprofile%\AppData\Local\Google\Chrome\User Data\Default\Cache\*.*"
del /s /q "%userprofile%\AppData\Local\Google\Chrome\User Data\Default\Code Cache\Js\*.*"
del /s /q "%userprofile%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\*.*"
del /s /q "%userprofile%\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\Js\*.*"
del /s /q "%userprofile%\AppData\Local\Opera Software\Opera Stable\Default\Cache\Cache_Data\*.*" >nul
del /s /q "%userprofile%\AppData\Local\Yandex\YandexBrowser\User Data\Default\Cache\*.*" >nul
del /s /q C:\Windows\Temp\*.* >nul
del /s /q "%userprofile%\AppData\Local\temp\*.*" >nul
del /s /q C:\Windows\Minidump\*.dmp >nul
endbatch:
Reg: reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules C:\Firewall.reg
C:\Firewall.reg
CMD: netsh advfirewall reset
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyTemp:
Reboot:
End::