Windows 10: Неверифицированые файлы в Autoruns с пометкой Windows.

Я обнаружил странные файлы, я не Устанавливал WSL, поэтому я уверен что тут что-то не так и есть вирус.Edit:Забыл упомянуть что перед перезагрузкой компьютера вышла ошибка запуска Powershell, и при запуске позапускалось окон 6-7 с PowerShell и длинными командами в них.

:)

 

Windows 10 Autorun?

Hello,

As you are asking whether the security of disabling Autorun/Autoplay option from system settings is the same as disabling from the registry and will take affect in the same way. There is no need to worry about virus threats which usually attack from autorun/autoplay.
If you want to disable autorun/autoplay from registry, follow the steps provided below:

• Type regedit in the search box and press Enter.
• Navigate to the following location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
• In the right pane of the window create a new DWORD value "NoDriveTypeAutorun".
• Set the value based on the following requirements:
  • FF – To disable AutoRun on all drives
  • 20 – To disable AutoRun on CD-ROM drives
  • 4 – To disable AutoRun on removable drives
  • 8 – To disable AutoRun on fixed drives
  • 10 – To disable AutoRun on network drives
  • 40 – To disable AutoRun on RAM disks
  • 1 – To disable AutoRun on unknown drives
• If you want to disable AutoRun on a certain combination of drives, you’ll have to combine their values. For example, if you want to disable AutoRun on CD-ROM and removable drives, set the value of DWORD to 28.
• If you want to return AutoRun functionality, just delete the NoDriveTypeAutorun DWORD value.

Note: This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore,
make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following
article number to view the article in the Microsoft Knowledge Base:

322756 (How to back up and restore the registry in Windows - Microsoft Support )

How to back up and restore the registry in Windows


Hope this helps. Keep us posted on the status for further assistance.

 

How can I remove this virus remnant?

I was also going to suggest Autoruns.

Check to make sure it isn't attaching itself to explorer. It should be the 3rd thing listed in Autoruns, the listing for the Shell. It should just be Explorer.exe. If it is anything else, that might be your problem.

 

USB Autorun each time windows boots?

If the hard drive is always left plugged-in then i also think you should check the autorun options for that drive...don't necessarily have to turn autorun off completely.
I don't remember well in Win7, i don't have a machine with that os now in my hands, but i think you should check the properties in the apps bar(right click on it), there are some options that deal separately with each device type (discs, hds, printers etc), among them should be an option about you external usb drive(autorun).

Otherwise, under devices (start, type devices - not device manager), find listed you ext usb drive and right click on it.There should be all kind of options available with a hd.

Cheerz