Стартовая страница в браузерах не меняется

[Emily]

После скачивание электронной книги, поймала кучу вирусов. Стали появляться всякие программы, браузеры Амиго, Комета и пр. После сканирование антивирусом, вроде все удалила, но во всех браузерах стала открываться стартовая страница yapages.ru и она никак не меняется, не смотря на настройки все равно открывается. Что делать?

[Info_bot]

Уважаемый(ая) Emily, спасибо за обращение на наш форум!

Удаление вирусов - абсолютно бесплатная услуга на VirusInfo.Info. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в правилах оформления запроса о помощи.

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

[Vvvyg]

Выполните скрипт в AVZ:

begin
 TerminateProcessByName('c:\users\pc\appdata\roaming\21cf5c00-1432798795-11b2-8000-9b3f66b91d9b\hnss6655.tmp');
 SetServiceStart('rinizisu', 4);
 StopService('rinizisu');
 QuarantineFile('C:\Users\PC\appdata\local\microsoft\start menu\вoйти в интeрнeт.exe', '');
 QuarantineFile('C:\Users\PC\appdata\local\kometa\kometaup.exe', '');
 QuarantineFile('C:\Program Files (x86)\Common Files\Adobe\OOBA\PDApp\PPAPI\764693BB-CE80-4684-8F41-D1FB268C4711.exe', '');
 QuarantineFile('C:\Users\PC\AppData\Roaming\J8B6tSX.exe', '');
 QuarantineFile('C:\Users\PC\AppData\Roaming\gd2LPHwCnCPCIv.exe', '');
 QuarantineFile('C:\ProgramData\LolliScan\LolliScan.exe', '');
 QuarantineFile('C:\Users\PC\AppData\Roaming\Browsers\exe.resworb.bat', '');
 QuarantineFile('C:\Users\PC\AppData\Roaming\Browsers\exe.erolpxei.bat', '');
 QuarantineFile('C:\ProgramData\KRB Updater Utility\krbupdater-utility.exe', '');
 QuarantineFile('c:\users\pc\appdata\roaming\21cf5c00-1432798795-11b2-8000-9b3f66b91d9b\hnss6655.tmp', '');
 DeleteFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Tabs.lnk');
 DeleteFile('C:\Users\PC\AppData\Roaming\21CF5C00-1432798795-11B2-8000-9B3F66B91D9B\hnss6655.tmp', '32');
 DeleteFile('C:\Program Files (x86)\MiPony\MiPony.exe', '32');
 DeleteFile('C:\ProgramData\KRB Updater Utility\krbupdater-utility.exe', '32');
 DeleteFile('C:\Users\PC\AppData\Roaming\Browsers\exe.erolpxei.bat', '32');
 DeleteFile('C:\Users\PC\AppData\Roaming\Browsers\exe.resworb.bat', '32');
 DeleteFile('C:\windows\Tasks\APSnotifierPP1.job', '64');
 DeleteFile('C:\windows\Tasks\APSnotifierPP2.job', '64');
 DeleteFile('C:\windows\Tasks\APSnotifierPP3.job', '64');
 DeleteFile('C:\ProgramData\LolliScan\LolliScan.exe', '32');
 DeleteFile('C:\windows\Tasks\DTZQTVJK1.job', '64');
 DeleteFile('C:\Users\PC\AppData\Roaming\gd2LPHwCnCPCIv.exe', '32');
 DeleteFile('C:\windows\Tasks\gd2LPHwCnCPCIv.job', '64');
 DeleteFile('C:\windows\Tasks\globalUpdateUpdateTaskMachineCore.job', '64');
 DeleteFile('C:\windows\Tasks\globalUpdateUpdateTaskMachineUA.job', '64');
 DeleteFile('C:\Users\PC\AppData\Roaming\J8B6tSX.exe', '32');
 DeleteFile('C:\windows\Tasks\J8B6tSX.job', '64');
 DeleteFile('C:\windows\Tasks\Price Fountain.job', '64');
 DeleteFile('C:\windows\Tasks\SpeedUpMyPC.job', '64');
 DeleteFile('C:\windows\Tasks\spmonitor.job', '64');
 DeleteFile('C:\Program Files (x86)\Common Files\Adobe\OOBA\PDApp\PPAPI\764693BB-CE80-4684-8F41-D1FB268C4711.exe', '32');
 DeleteFile('C:\Users\PC\appdata\local\kometa\kometaup.exe', '32');
 DeleteFile('C:\Users\PC\appdata\local\microsoft\start menu\вoйти в интeрнeт.exe', '32');
 DeleteService('wkdndjrh');
 DeleteService('wkcaxyer');
 DeleteService('wgyeybwo');
 DeleteService('wgepjeja');
 DeleteService('wgbbkcuv');
 DeleteService('wdsjieoo');
 DeleteService('vkccjtzt');
 DeleteService('vhnlioui');
 DeleteService('uzokxaph');
 DeleteService('uxvdvrni');
 DeleteService('usbnayze');
 DeleteService('uichnjte');
 DeleteService('tzqfmfoh');
 DeleteService('twntunja');
 DeleteService('tnzxzfvd');
 DeleteService('tftghpua');
 DeleteService('syycsmbg');
 DeleteService('slytkspu');
 DeleteService('scftzpgv');
 DeleteService('sbuyljwv');
 DeleteService('rkqrjlaz');
 DeleteService('riodzixp');
 DeleteService('rhkysueg');
 DeleteService('renagqag');
 DeleteService('qysndxns');
 DeleteService('qwppriwr');
 DeleteService('qrmoeobv');
 DeleteService('qgtmnkzx');
 DeleteService('qaoztdvj');
 DeleteService('pytyuuht');
 DeleteService('pwrtmlgq');
 DeleteService('ptabtajp');
 DeleteService('ppwuxhjg');
 DeleteService('ouymaomi');
 DeleteService('orawykzn');
 DeleteService('oopwdkgl');
 DeleteService('ojznffit');
 DeleteService('ohkejcir');
 DeleteService('ofunwuui');
 DeleteService('oerxghyi');
 DeleteService('oauikhce');
 DeleteService('nvjggqgz');
 DeleteService('nsqgdczj');
 DeleteService('npstjwsh');
 DeleteService('nmnbunhi');
 DeleteService('nehjtqwn');
 DeleteService('mwzvlmik');
 DeleteService('mwrwznhl');
 DeleteService('lsddbfjy');
 DeleteService('lokvejcw');
 DeleteService('llgpofwa');
 DeleteService('ldkxspoo');
 DeleteService('lbkcebvo');
 DeleteService('kzkwdabf');
 DeleteService('kzkmyblh');
 DeleteService('kuncvfpa');
 DeleteService('ktuagjwo');
 DeleteService('krrxrseo');
 DeleteService('kgsvzcaw');
 DeleteService('jvjapzhj');
 DeleteService('jvbfichy');
 DeleteService('jpsqonjj');
 DeleteService('jlbmemlu');
 DeleteService('jburoiwh');
 DeleteService('ixtbulgi');
 DeleteService('ipboeqwx');
 DeleteService('inyumchx');
 DeleteService('innfd_1_10_0_14');
 DeleteService('ijmmcahg');
 DeleteService('igkjruqh');
 DeleteService('ibqlouhx');
 DeleteService('iazqkhqe');
 DeleteService('hdqolpgc');
 DeleteService('gufdyntr');
 DeleteService('gnswbflk');
 DeleteService('gfregnnd');
 DeleteService('gfezmvnl');
 DeleteService('gcvplnhb');
 DeleteService('fzhshdqu');
 DeleteService('fvymabjl');
 DeleteService('fvuldswd');
 DeleteService('fqrnzgha');
 DeleteService('fojglnak');
 DeleteService('fnsuqfmb');
 DeleteService('femptsha');
 DeleteService('ezdwgluq');
 DeleteService('eygjxqeh');
 DeleteService('eurvaish');
 DeleteService('epkvydte');
 DeleteService('ekmecjwu');
 DeleteService('ejvtdjhq');
 DeleteService('ejpsqcdj');
 DeleteService('eikduqes');
 DeleteService('ecnxanpa');
 DeleteService('dsdmmydy');
 DeleteService('dqcugteq');
 DeleteService('dodyelzb');
 DeleteService('dmtgaowq');
 DeleteService('dieqwqqs');
 DeleteService('dfqhidft');
 DeleteService('cwjpubve');
 DeleteService('cnpcccgj');
 DeleteService('cktgsaoo');
 DeleteService('cjvreofc');
 DeleteService('bgqxdjpe');
 DeleteService('bekgdavj');
 DeleteService('axnpmgpr');
 DeleteService('anwiftdg');
 DeleteService('agegxjwc');
 DeleteService('afuglzvs');
 DeleteService('afretcgl');
 DeleteService('aelmouyf');
 DeleteService('adlnnqoy');
 DeleteService('abkswctf');
 DeleteService('rinizisu');
 DeleteFileMask('C:\Users\PC\AppData\Roaming\21CF5C00-1432798795-11B2-8000-9B3F66B91D9B', '*', true);
 DeleteFileMask('C:\Program Files (x86)\MiPony', '*', true);
 DeleteFileMask('C:\ProgramData\KRB Updater Utility', '*', true);
 DeleteFileMask('C:\ProgramData\LolliScan', '*', true);
 DeleteFileMask('C:\Users\PC\appdata\local\kometa', '*', true);
 DeleteDirectory('C:\Users\PC\AppData\Roaming\21CF5C00-1432798795-11B2-8000-9B3F66B91D9B');
 DeleteDirectory('C:\Program Files (x86)\MiPony');
 DeleteDirectory('C:\ProgramData\KRB Updater Utility');
 DeleteDirectory('C:\ProgramData\LolliScan');
 DeleteDirectory('C:\Users\PC\appdata\local\kometa');
 DelBHO('{898EA8C8-E7FF-479B-8935-AEC46303B9E5}');
 DelBHO('{fe704bf8-384b-44e1-8cf2-8dbeb3637a8a}');
 DelBHO('{b608cc98-54de-4775-96c9-097de398500c}');
 DelBHO('{01A13E40-2F55-4397-B39B-7851BCFB8008}');
 ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP1" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP2" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP3" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "DTZQTVJK1" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "globalUpdateUpdateTaskMachineCore" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "globalUpdateUpdateTaskMachineUA" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "KRB Updater Utility" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "LaunchPreSignup" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "Microsoft\Windows\AEEBC92EC-1A51-4610-9D5F-87376B0B276E" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "Microsoft\Windows\EEBC92EC-1A51-4610-9D5F-87376B0B276E" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "Microsoft\Windows\KRBUUS\KRB Updater Utility Service" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "SmartWeb Upgrade Trigger Task" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "Soft installer" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "SpeedUpMyPC" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "spmonitor" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "{8C826B55-F043-442B-9B5F-76804C531AD4}" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "{90CEBFD8-B03A-4F39-BFE4-77B70214F243}" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "{F7F49819-1044-4F75-B8E1-55A6B44DE835}" /F', 0, 15000, true);
ExecuteSysClean;
 ExecuteRepair(22);
 ExecuteRepair(4);
 ExecuteRepair(3);
 ExecuteWizard('SCU', 2, 2, true);
RebootWindows(true);
end.

Компьютер перезагрузится.
Выполните в AVZ скрипт:

begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.

В папке с AVZ появится архив карантина quarantine.zip, отправьте этот файл по ссылке "Прислать запрошенный карантин" над над первым сообщением в теме.

Выполните 2-й стандартный скрипт в AVZ и прикрепите к своему следующему сообщению файл virusinfo_syscheck.zip.

Сделайте лог AdwCleaner (by Xplode).
Сделайте лог Check Browsers' LNK.