Trojan:win32/phonzy Wacatac B!ml

Start::
SystemRestore: On
CreateRestorePoint:
HKU\S-1-5-21-1189134787-2056096328-1149260543-1001\...\Run: [mls] => C:\Users\rusla\AppData\Roaming\RAC\mls.exe [1626112 2022-05-12] () [Файл не подписан]
HKU\S-1-5-21-1189134787-2056096328-1149260543-1001\...\Run: [svcsc.exe] => C:\Users\rusla\AppData\Roaming\RAC\svcsc.exe [0 2022-05-12] () <==== ВНИМАНИЕ [нулевой байт Файл/Папка]
File: C:\Users\rusla\AppData\Roaming\RAC\mls.exe
C:\Users\rusla\AppData\Roaming\RAC\mls.exe
Folder: C:\Program Files\MS Office 2010
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [7394]
StartBatch:
  ECHO Y|CHKDSK C: /F
  pushd c:\windows\system32
  bcdedit.exe /set {default} recoveryenabled yes
  net stop bits
  net stop cryptSvc
  net stop wuauserv
  net stop msiserver
  del /s /q C:\Windows\SoftwareDistribution\download\*.*
  del /s /q "%userprofile%\AppData\Local\Google\Chrome\User Data\Default\Cache\*.*"
  del /s /q "%userprofile%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\*.*"
  netsh winsock reset catalog
  netsh int ipv4 reset reset.log
  netsh int ipv6 reset reset.log
  ipconfig /release
  ipconfig /renew
  ipconfig /flushdns
  ipconfig /registerdns
  net start bfe
  net start bits
  net start cryptSvc
  net start eventsystem
  net start msiserver
  net start rpcss
  net start sdrsvc
  net start trustedinstaller
  net start vss
  net start winmgmt
  net start wuauserv
  netsh winhttp reset proxy
  bitsadmin /list /allusers
  bitsadmin /reset /allusers
  netsh advfirewall reset
  netsh advfirewall set allprofiles state ON
EndBatch:
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
C:\Windows\Temp\*.*
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
EmptyTemp:
Reboot:
End::