Plz Analyze this log.

[xinginer]

I found that my contacts received messages on telegram that i didn't send.

you can find my hijackthis log below

HiJackThis.log

[Sandor-Helper]

Hi,
If you need our assistance:

• Read carefully: How to make a request for help in the PC cure section
• Attach 'Collection-[Date].zip' log created by AutoLogger

Please, note that only members of VIRUSNET-Association are allowed to respond to PC cure topics. Ignore any recommendations given by other users, including PM !!!

Assistance is provided free of charge in our free time. If you found our help useful, you can thank us with any amount using this form or you can leave feedback in Guestbook.

[xinginer]

Thanks a lot.
here is the log

CollectionLog-2025.08.24-00.26.zip

[Sandor-Helper]

Thank you.
I didn' see any suspicious so far. Lets get more logs.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click to run as administrator. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce logs called FRST.txt and Addition.txt in the same directory the tool is run from.
• Please attach the logs back here.

[xinginer]

I am grateful for your help, again yesterday google detected a Suspicious activity in my account. (Unknown device (Signed out))
I changed the password and run a check test.

I also scanned with Farbar this is the logs you asked for.

Addition.txt
FRST.txt

[xinginer]

This is google message:

Device with suspicious activity
Google detected suspicious activity in your account that indicates you may have harmful software (malware) on one of your devices. Malware can be used to steal personal information, including passwords.
Run an antivirus to scan for harmful software.

[Sandor-Helper]

Temporarily turn off any antivirus.
Highlight following code (or press Copy button):

Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
HKU\S-1-5-21-3217088579-4174292587-2633433759-1001\...\MountPoints2: {a9da0fdf-122a-11f0-bb6d-48ba4e89bcaf} - "E:\SISetup.exe" 
Task: {8094AA5D-2595-45A6-BDBC-90E725D6C149} - System32\Tasks\CfgHelper => C:\ProgramData\app_config\CfgHelper.exe [373344 2025-04-16] (Adersoft -> Adersoft) <==== ATTENTION
Task: {A9513033-E277-4D10-B1D4-A940ED484A51} - System32\Tasks\CfgMgr => C:\ProgramData\app_config\CfgMgr.exe [14965760 2025-06-25] (www.cfg.com) [File not signed] <==== ATTENTION
File: C:\ProgramData\app_config\CfgMgr.exe
Folder: C:\ProgramData\app_config
C:\ProgramData\app_config\CfgMgr.exe
2025-08-20 15:01 - 2025-08-20 15:10 - 000443809 _____ C:\Users\Ychra\AppData\Roaming\update_data.zip
2025-08-20 15:01 - 2025-08-20 15:10 - 000000187 _____ C:\Users\Ychra\AppData\Roaming\install_log.txt
2025-08-20 15:01 - 2025-08-20 15:10 - 000000169 _____ C:\Users\Ychra\AppData\Roaming\run_helper.vbs
2025-08-20 15:01 - 2025-08-20 15:10 - 000000000 ____D C:\Users\Ychra\AppData\Roaming\app_config
2025-08-20 15:01 - 2025-08-20 15:01 - 000003514 _____ C:\Windows\system32\Tasks\CfgHelper
2025-08-20 15:01 - 2025-08-20 15:01 - 000003500 _____ C:\Windows\system32\Tasks\CfgMgr
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`27hfm [0]
FirewallRules: [{A723BBBD-5B2A-4513-BCEC-60E15178F1BC}] => (Allow) LPort=57209
FirewallRules: [{48B2359F-3970-4F6A-8BDF-9D3BD8DBEE9E}] => (Allow) LPort=57210
FirewallRules: [{4907B6C0-E217-4E4A-9B2E-5B7EC05247F8}] => (Allow) LPort=57211
FirewallRules: [{1E22D9CA-FD17-49AD-9B4B-61AD9ED7EC6E}] => (Allow) LPort=57212
FirewallRules: [{E157E4D8-FF61-44D5-94D1-7501AC27C076}] => (Allow) LPort=57213
FirewallRules: [{044C54F6-AC89-410A-BEF1-3D86194B0EA1}] => (Allow) LPort=57214
FirewallRules: [{1F0A2BCA-6762-4EC1-B36C-90B980774752}] => (Allow) LPort=57215
FirewallRules: [{26D57F39-3805-4DA5-A17B-C72C5342A3F0}] => (Allow) LPort=57216
FirewallRules: [{DC14A8AD-3DD3-4D8B-9E10-EC1DA553F661}] => (Allow) LPort=57217
FirewallRules: [{4C1C8B04-84F9-499D-8ABD-853AD5F3D9A0}] => (Allow) LPort=57218
FirewallRules: [{3B2E2B5D-129F-4CC6-9C7D-F91C58AC0C31}] => (Allow) LPort=57209
FirewallRules: [{5E650DF0-BD6B-4946-B7DA-F93CD3BFC21A}] => (Allow) LPort=57210
FirewallRules: [{F0004D26-074D-4A0D-BAB7-EF6962020F2F}] => (Allow) LPort=57211
FirewallRules: [{65283EFD-DA95-492D-B5C7-BED89AC2E6BE}] => (Allow) LPort=57212
FirewallRules: [{0D940ACE-10CA-4589-B995-4F5715BBE3CF}] => (Allow) LPort=57213
FirewallRules: [{9C0C883F-0592-4C75-A2BE-7588A83F5F66}] => (Allow) LPort=57214
FirewallRules: [{C90FA136-5E5E-454B-88AA-E164C891674E}] => (Allow) LPort=57215
FirewallRules: [{AB12052A-724D-45CF-8D09-ED07DA7124B4}] => (Allow) LPort=57216
FirewallRules: [{CC6079B1-D1FF-4327-9E1A-311BC5F56210}] => (Allow) LPort=57217
FirewallRules: [{0B35E34B-9B52-49E0-A4FF-17AA068850E3}] => (Allow) LPort=57218
FirewallRules: [{94E38AB4-6203-4166-801E-889FCC7956D7}] => (Allow) LPort=23007
FirewallRules: [{64B1FF11-9B30-4078-8634-910E2185DCD0}] => (Allow) LPort=23008
FirewallRules: [{C6A99803-34F5-4A2D-8591-F9F080488868}] => (Allow) LPort=33009
FirewallRules: [{B1200D9D-8182-4F7C-9C12-08329AA24768}] => (Allow) LPort=33010
FirewallRules: [{46A359BA-3153-4237-8258-B2F2BAA53E91}] => (Allow) LPort=33011
FirewallRules: [{AE1215F7-9463-4710-87BB-2E07C019DAD8}] => (Allow) LPort=43012
FirewallRules: [{E3402EE5-C8A4-4EBC-865A-7EF26F17FF68}] => (Allow) LPort=43013
FirewallRules: [{7564D0FC-4721-41AC-A385-004DD62D19B5}] => (Allow) LPort=53014
FirewallRules: [{949C6032-255C-4409-A5B8-A75F10577126}] => (Allow) LPort=53015
FirewallRules: [{51EC3246-37D6-4EAA-8884-C8B8A5118504}] => (Allow) LPort=53016
FirewallRules: [{8713DC01-858C-45F5-BBF6-D220916FC118}] => (Allow) LPort=23007
FirewallRules: [{B32601BF-31D1-47E7-9C29-55D47B370B10}] => (Allow) LPort=23008
FirewallRules: [{A26DD247-CE47-493E-960B-9733847429E1}] => (Allow) LPort=33009
FirewallRules: [{8332A3C0-2C63-40F7-8BB3-FF5A8EAB63F9}] => (Allow) LPort=33010
FirewallRules: [{31B4CD7F-1E6D-49D7-82E5-26B2C068962A}] => (Allow) LPort=33011
FirewallRules: [{5A891F20-B180-43CD-A330-642C6FE86F29}] => (Allow) LPort=43012
FirewallRules: [{292C1515-5753-439C-B6B5-5D5A12AB31D9}] => (Allow) LPort=43013
FirewallRules: [{108A746B-D952-49EB-BC3A-C828D6B6421C}] => (Allow) LPort=53014
FirewallRules: [{61AE230F-5CF6-43F8-8880-9775DCCBE98B}] => (Allow) LPort=53015
FirewallRules: [{E796B6ED-FD4B-4B0C-8579-93B3F3C9A94C}] => (Allow) LPort=53016
FirewallRules: [{0ACBCD88-6ABF-44D3-948A-0F33C7A838F5}] => (Allow) LPort=50053
FirewallRules: [{DBB2B388-1D32-44A4-B3D2-C72EB6141484}] => (Allow) LPort=50053
Zip: c:\FRST\Quarantine\
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyTemp:
Reboot:
End::

Copy highlighted text (right click - Copy).
Run FRST (FRST64) as Administrator.
Press Fix button once and wait. Program will create (Fixlog.txt). Attach it to the next post.
You don't have to paste the code, it will be taken straight from the clipboard.

PC will reboot.

[xinginer]

Fixlog.txt

[Sandor-Helper]

Thank you, the script ran well and it have cleaned some malware objects.
Please find at your Desktop this archive:

C:\Users\Ychra\Desktop\27.08.2025_11.36.07.zip

Send it to me via this form. If it will be oversized then upload it to any cloud storage and give me a link to download.

Also you have to delete two malicious exclusions in Windows Defender.

After that please watch and see how your system will be working. Tell us a result in a couple of days.