Словил Taskhostw.exe

begin
 RegKeyIntParamWrite('HKEY_LOCAL_MACHINE', 'SYSTEM\ControlSet001\Control\Remote Assistance', 'fAllowToGetHelp', 0);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1804', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
 RegKeyIntParamWrite('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Control\LSA', 'RestrictAnonymous', 2);
 ExecuteWizard('TSW', 2, 3, true);
RebootWindows(true);
end.

O4 - HKLM\..\Session Manager: [PendingFileRenameOperations] = *1\??\C:\Users\Иван\AppData\Local\Temp\C16F9800-ABF9-11EF-AD64-F5B17DD83892 -> DELETE (file missing)
O4 - HKLM\..\Session Manager: [PendingFileRenameOperations2] = *1\??\C:\Users\Иван\AppData\Local\Temp\382CBDD4-A122F280-504BBF87-37AE2F2B\1c31fd782.sys.13b3c3.13bc00 -> DELETE (file missing)
O7 - KnownFolder:  (folder missing)
O7 - KnownFolder: C:\Users\defaultuser0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup (folder missing)
O22 - Tasks: \Microsoft\Windows\Containers\CmCleanup - {F50E9363-6BC8-4DC5-8CAB-7D9F8C1B81B4} - (no file)
O26 - Tools: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\SpeakForMe [StartExe] = C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SpeakForMe.exe (file missing)

Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Ограничение <==== ВНИМАНИЕ
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyTemp:
Reboot:
End::