Как-то подцепил Trojan:Win32/Pomal!rfn

begin
 TerminateProcessByName('c:\users\killer\appdata\roaming\utorrent\utorrentweb.exe');
 TerminateProcessByName('c:\users\killer\appdata\local\temp\2yvvtfhdxereencgrka7yh5me1q\setup.exe');
 QuarantineFile('c:\users\killer\appdata\roaming\utorrent\utorrentweb.exe', '');
 QuarantineFile('c:\users\killer\appdata\local\temp\2yvvtfhdxereencgrka7yh5me1q\setup.exe', '');
 DeleteFile('c:\users\killer\appdata\local\temp\2yvvtfhdxereencgrka7yh5me1q\setup.exe', '32');
 DeleteFile('c:\users\killer\appdata\roaming\utorrent\utorrentweb.exe', '32');
 DeleteFile('C:\Users\Killer\AppData\Roaming\utorrent\UtorrentWeb.exe', '64');
 DeleteSchedulerTask('UpdateTorrent');
ExecuteSysClean;
 ExecuteWizard('TSW', 2, 3, true);
RebootWindows(true);
end.

begin
 CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
end.

O15 - Trusted Zone: hxxp://hola.org
O18 - HKLM\Software\Classes\Protocols\Filter\application/octet-stream: [CLSID] = {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - (no file)
O18 - HKLM\Software\Classes\Protocols\Filter\application/x-complus: [CLSID] = {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - (no file)
O18 - HKLM\Software\Classes\Protocols\Filter\application/x-msdownload: [CLSID] = {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - (no file)
O18 - HKLM\Software\Classes\Protocols\Handler\ms-help: [CLSID] = {314111C7-A502-11D2-BBCA-00C04F8EC294} - (no file)
O22 - BITS Job: Fix all (including legit)
O22 - Tasks: UpdateTorrent - C:\Users\Killer\AppData\Roaming\utorrent\UtorrentWeb.exe (not signed - no company - 55DC5E834AE54FC96C9E55C829DAB29D7A3C025A)
O23 - Driver S1: beydntob - C:\Windows\system32\drivers\beydntob.sys (file missing) (+safe mode)
O23 - Driver S1: EneTechIo - C:\Windows\system32\drivers\ene.sys (file missing)
O23 - Driver S1: fchaknfy - C:\Windows\system32\drivers\fchaknfy.sys (file missing) (+safe mode)
O23 - Driver S1: mgqvwwyn - C:\Windows\system32\drivers\mgqvwwyn.sys (file missing) (+safe mode)
O23 - Driver S3: EAAntiCheat - C:\Windows\system32\drivers\eaanticheat.sys (file missing)
O26-32 - Office Addin: HKLM\..\WordEEFonts.Connect - (Microsoft Word East European Fonts Tool) -> (no file)

Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
Unlock: C:\FRST\
RemoveProxy:
C:\Users\Killer\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ndcileolkflehcjpmjnfbnaibdcgglog
FF Extension: (Adblock Plus - бесплатный блокировщик рекламы) - C:\Users\Killer\AppData\Roaming\Mozilla\Firefox\Profiles\plnjqj58.default-release\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2025-07-16]
C:\Users\Killer\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndnmpdjbkobboegpecohbchkllcianol
CHR HKU\S-1-5-21-109977174-3309212224-3965005268-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKU\S-1-5-21-109977174-3309212224-3965005268-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjbepbhonbojpoaenhckjocchgfiaofo]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CustomCLSID: HKU\S-1-5-21-109977174-3309212224-3965005268-1001_Classes\CLSID\{14100442-9664-1407-2647-000000000000}\localserver32 -> "C:\Users\Killer\AppData\Local\Wondershare\Wondershare NativePush\WsToastNotification.exe" -ToastActivated => Нет файла
Reg: reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules C:\Firewall.reg
C:\Firewall.reg
CMD: netsh advfirewall reset
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
Zip: C:\FRST\Quarantine
EmptyTemp:
Reboot:
End::