После kms auto появляется самовосстанавливающаяся папка с trojan (czyuzabpfprl и ztbhbqffszlu)

Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\MRT: Ограничение <==== ВНИМАНИЕ
HKU\S-1-5-21-3886238892-1396614520-399636955-1001\...\MountPoints2: {cf2cb4f9-9bad-11f0-80c4-345a6065f358} - "F:\SISetup.exe" 
HKU\S-1-5-21-3886238892-1396614520-399636955-1001\...\MountPoints2: {cf2cb648-9bad-11f0-80c4-345a6065f358} - "F:\SISetup.exe" 
Policies: C:\ProgramData\NTUSER.pol: Ограничение <==== ВНИМАНИЕ
HKLM\SOFTWARE\Policies\Microsoft\Edge: Ограничение <==== ВНИМАНИЕ
Task: {F7B75D14-415D-4D3D-B945-C4A65FCEB34A} - System32\Tasks\MaintenanceUninstalledSystemApps => C:\Windows\System32\cmd.exe [339968 2025-12-10] (Microsoft Windows -> Microsoft Corporation) -> %SystemRoot%\System32\\/d /q /e:on /v:on /c "chcp 65001>nul&set err=0&set key=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore&(for /f "tokens=1* delims=" %I in ('^(reg.exe query !key!\InboxApplications^&reg.exe query !key!\UpdatedApplications^)^|findstr /ir "\\Microsoft\.Windows (запись имеет ещё 89 символов).
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ограничение <==== ВНИМАНИЕ
HKU\S-1-5-21-3886238892-1396614520-399636955-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Ограничение <==== ВНИМАНИЕ
CHR HKU\S-1-5-21-3886238892-1396614520-399636955-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ldgpjdiadomhinpimgchmeembbgojnjk]
S2 CPHEWXYP; C:\ProgramData\czyuzabpfprl\kcqvanzcsiaa.exe [2874368 0] () [Файл не подписан] <==== ВНИМАНИЕ
U2 dosvc_bkp; C:\Windows\system32\dosvc.dll [98304 2025-12-10] (Microsoft Windows -> Microsoft Corporation)
S2 NNWNJSZB; C:\ProgramData\ztbhbqffszlu\knhxxdxxcljq.exe [X] <==== ВНИМАНИЕ
2026-01-13 09:49 - 2026-01-13 10:00 - 000000000 ____D C:\ProgramData\czyuzabpfprl
2026-01-13 09:39 - 2026-01-13 10:00 - 000000000 ____D C:\ProgramData\ztbhbqffszlu
AlternateDataStreams: C:\Users\Public\desktop.ini:WinDeviceId [64]
StartPowerShell:
Remove-MpPreference -ExclusionPath "C:\Users\User"
Remove-MpPreference -ExclusionPath "C:"
Remove-MpPreference -ExclusionPath "C:\Windows\system32\config\systemprofile"
Remove-MpPreference -ExclusionPath "C:\ProgramData"
EndPowerShell:
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
StartRegedit:
Windows Registry Editor Version 5.00
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DoSvc]
"DependOnService"=hex(7):72,00,70,00,63,00,73,00,73,00,00,00,00,00
"Description"="@%systemroot%\\system32\\dosvc.dll,-101"
"DisplayName"="@%systemroot%\\system32\\dosvc.dll,-100"
"ErrorControl"=dword:00000001
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
  00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00,00,00,00,00,00,00,00,00
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,53,00,65,00,72,00,76,\
  00,69,00,63,00,65,00,20,00,2d,00,70,00,00,00
"LaunchProtected"=dword:00000002
"ObjectName"="NT Authority\\NetworkService"
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
  00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  64,00,6f,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceSidType"=dword:00000001
"Start"=dword:00000002
"SvcMemHardLimitInMB"=dword:00000027
"SvcMemMidLimitInMB"=dword:0000001b
"SvcMemSoftLimitInMB"=dword:0000000f
"Type"=dword:00000010
"DelayedAutostart"=dword:00000001
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DoSvc\Security]
"Security"=hex:01,00,14,80,a0,00,00,00,ac,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,70,00,04,00,00,00,00,00,14,00,9d,00,02,00,01,01,00,00,00,00,00,\
  05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00,00,00,05,12,00,00,00,00,\
  00,28,00,22,00,02,00,01,06,00,00,00,00,00,05,50,00,00,00,4d,f8,19,b6,b3,a7,\
  7f,e3,93,9a,10,ee,20,5d,51,ab,9b,39,b9,82,01,01,00,00,00,00,00,05,12,00,00,\
  00,01,01,00,00,00,00,00,05,12,00,00,00
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DoSvc\TriggerInfo]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DoSvc\TriggerInfo\0]
"Action"=dword:00000001
"Data0"=hex:75,10,bc,a3,29,01,c6,41
"DataType0"=dword:00000001
"GUID"=hex:16,28,7a,2d,5e,0c,fc,45,9c,e7,57,0e,5e,cd,e9,c9
"Type"=dword:00000007
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DoSvc\TriggerInfo\1]
"Action"=dword:00000001
"GUID"=hex:e6,ca,9f,65,db,5b,a9,4d,b1,ff,ca,2a,17,8d,46,e0
"Type"=dword:00000005
 
EndRegedit:
EmptyTemp:
Reboot:
End::

Start::
CloseProcesses:
HKLM\...\Policies\Explorer: [HideSCAMeetNow] 1
HKLM\SOFTWARE\Policies\Microsoft\MRT: Ограничение <==== ВНИМАНИЕ
S2 BITS_bkp; C:\Windows\System32\qmgr.dll [1474560 2025-12-10] (Microsoft Windows -> Microsoft Corporation)
U2 dosvc_bkp; C:\Windows\system32\dosvc.dll [98304 2025-12-10] (Microsoft Windows -> Microsoft Corporation)
S2 UsoSvc_bkp; C:\Windows\system32\usosvc.dll [110592 2025-12-10] (Microsoft Windows -> Microsoft Corporation)
S3 WaaSMedicSvc_bkp; C:\Windows\System32\WaaSMedicSvc.dll [94208 2025-12-10] (Microsoft Windows -> Microsoft Corporation)
S3 wuauserv_bkp; C:\Windows\system32\wuaueng.dll [184720 2025-12-10] (Microsoft Windows -> Корпорация Майкрософт)
S2 NNWNJSZB; C:\ProgramData\ztbhbqffszlu\knhxxdxxcljq.exe [X]
2026-01-13 14:30 - 2026-01-13 15:34 - 000000000 ____D C:\ProgramData\ztbhbqffszlu
2026-01-13 14:30 - 2026-01-13 15:34 - 000000000 ____D C:\ProgramData\czyuzabpfprl
StartPowershell:
Remove-MpPreference -ExclusionExtension ".exe"
Remove-MpPreference -ExclusionPath "C:\Windows\system32\config\systemprofile"
Remove-MpPreference -ExclusionPath "C:\ProgramData"
Remove-MpPreference -ExclusionPath "C:\Windows\Setup\Scripts"
EndPowerShell:
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
Reboot:
End::