VIRY.CZ

Kód: Vybrat vše

Start
CloseProcesses:
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKU\S-1-5-21-4148571483-3592684963-3718319802-1001\...\Run: [DQCIKCDACO] => C:\ProgramData\certlm.exe [498784 2022-10-25] (Adersoft -> Adersoft) <==== ATTENTION
HKU\S-1-5-21-4148571483-3592684963-3718319802-1001\...\MountPoints2: {8a5d371e-ef25-11e9-9cd1-40b0765e7062} - "E:\autorun.exe"
HKU\S-1-5-21-4148571483-3592684963-3718319802-1001\...\MountPoints2: {8a5d48ca-ef25-11e9-9cd1-40b0765e7062} - "F:\CDCheck.exe" 
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk [2020-09-30]
ShortcutTarget: $McRebootA5E6DEAA56$.lnk -> (No File)
Startup: C:\Users\Public\Data\certlm.exe [2022-10-25] (Adersoft -> Adersoft)
Startup: C:\Users\Public\Data\h.vbs.lnk [2023-02-06]
ShortcutTarget: h.vbs.lnk -> C:\ProgramData\h.vbs () [File not signed]
Startup: C:\Users\Public\Data\IDM.bat [2023-03-01] () [File not signed]
2023-02-06 18:22 - 2023-02-06 18:22 - 000000000 _____ C:\Users\Petr\AppData\Roaming\AE79.tmp
2022-11-01 11:50 - 2022-11-01 11:50 - 000000000 _____ () C:\Users\Petr\AppData\Roaming\85AA.tmp
2022-10-25 08:32 - 2022-10-25 08:32 - 000498784 _____ (Adersoft) C:\ProgramData\certlm.exe



EmptyTemp:
Reboot:
End