Банер в браузере

С помощью хрома невозможно зайти в вк, он удаляет логин и пароль. Появляются банеры, и создается вкладка и переходит на левую страничкой.

Уважаемый(ая) [B]Rafa At[/B], спасибо за обращение на наш форум!

Помощь в лечении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в [URL="http://virusinfo.info/pravila.html"]правилах оформления запроса о помощи[/URL].

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста [URL="http://virusinfo.info/content.php?r=113-virusinfo.info-donate"]поддержите проект[/URL].

Выполните скрипт в AVZ
[code]begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
QuarantineFile('C:\Program Files (x86)\YTDownloader\updater.exe','');
QuarantineFile('C:\Program Files (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.exe','');
QuarantineFile('C:\Program Files (x86)\ShopperPro\updater.exe','');
QuarantineFile('C:\Program Files (x86)\ShopperPro\ShopperPro.exe','');
QuarantineFile('C:\Users\Раф\AppData\Local\Microsoft\Extensions\extsetup.exe','');
QuarantineFile('C:\Program Files (x86)\ver7SpeedCheck\y3SpeedCheckG56.exe','');
QuarantineFile('C:\Users\Раф\AppData\Roaming\newSI_612\s_inst.exe','');
QuarantineFile('C:\Users\Раф\AppData\Roaming\newSI_611\s_inst.exe','');
QuarantineFile('C:\Users\Раф\AppData\Roaming\newSI_608\s_inst.exe','');
QuarantineFile('C:\Users\Раф\AppData\Roaming\newSI_604\s_inst.exe','');
QuarantineFile('C:\Users\Раф\AppData\Roaming\KMMZZPZR.exe','');
QuarantineFile('C:\Program Files (x86)\Ge-Force\9a55fd01-b13e-49f1-85a7-d864dc745d92-7.exe','');
QuarantineFile('C:\Program Files (x86)\Ge-Force\9a55fd01-b13e-49f1-85a7-d864dc745d92-6.exe','');
QuarantineFile('C:\Program Files (x86)\Ge-Force\9a55fd01-b13e-49f1-85a7-d864dc745d92-5.exe','');
QuarantineFile('C:\Program Files (x86)\Ge-Force\9a55fd01-b13e-49f1-85a7-d864dc745d92-2.exe','');
QuarantineFile('C:\Program Files (x86)\Ge-Force\9a55fd01-b13e-49f1-85a7-d864dc745d92-11.exe','');
QuarantineFile('C:\Program Files (x86)\Ge-Force\Ge-Force-codedownloader.exe','');
QuarantineFile('C:\Program Files (x86)\Sense\19cb93ae-e780-4a31-a04e-02c8330c663b-7.exe','');
QuarantineFile('C:\Program Files (x86)\Sense\19cb93ae-e780-4a31-a04e-02c8330c663b-6.exe','');
QuarantineFile('C:\Program Files (x86)\Sense\19cb93ae-e780-4a31-a04e-02c8330c663b-5.exe','');
QuarantineFile('C:\Program Files (x86)\Sense\19cb93ae-e780-4a31-a04e-02c8330c663b-2.exe','');
QuarantineFile('C:\Program Files (x86)\Sense\19cb93ae-e780-4a31-a04e-02c8330c663b-11.exe','');
QuarantineFile('C:\Program Files (x86)\Sense\Sense-codedownloader.exe','');
DelBHO('{1FE48F08-A2AC-44AC-A21C-0556D91C50DA}');
DelBHO('{3C6CF3C0-D800-4B4D-A3D8-8ADE406523B6}');
DelBHO('{7CE987D5-11B3-44FC-9C3D-03069360D462}');
QuarantineFile('C:\Program Files (x86)\VK Downloader\Toolbar32.dll','');
QuarantineFile('C:\Program Files (x86)\advPlugin\Toolbar32.dll','');
QuarantineFile('C:\Windows\RegPolicy\aticonto.exe','');
QuarantineFile('C:\Users\Раф\AppData\Roaming\eTranslator\eTranslator.exe','');
QuarantineFile('C:\Users\Раф\AppData\Local\storegid\storegid.exe','');
QuarantineFile('C:\Users\Раф\AppData\Local\Microsoft\Extensions\safebrowser.exe','');
QuarantineFile('C:\Users\Раф\AppData\Local\ConvertAd\ConvertAd.exe','');
QuarantineFile('C:\ProgramData\Kbupdater Utility\kbupdater-utility.exe','');
QuarantineFile('C:\Program Files (x86)\Zaxar\ZaxarLoader.exe','');
QuarantineFile('C:\Program Files (x86)\YTDownloader\YTDownloader.exe','');
QuarantineFile('C:\Program Files (x86)\Kinoroom Browser\kinoroom-browser.exe','');
QuarantineFile('C:\Windows\system32\drivers\{6addfddb-ea1d-40a6-89d8-c21f55872f83}Gw64.sys','');
QuarantineFile('C:\Windows\system32\drivers\{bcaab8ad-c85a-4df0-833c-bb1e038f56cc}w64.sys','');
QuarantineFile('C:\Windows\system32\drivers\{cca87299-eea0-4645-9629-a73bae49fd30}w64.sys','');
DeleteService('{cca87299-eea0-4645-9629-a73bae49fd30}w64');
DeleteService('{bcaab8ad-c85a-4df0-833c-bb1e038f56cc}w64');
DeleteService('{6addfddb-ea1d-40a6-89d8-c21f55872f83}Gw64');
DeleteService('SPDRIVER_1463.0.0.0');
QuarantineFile('C:\Program Files (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.sys','');
QuarantineFile('C:\PROGRA~2\YTDOWN~1\sbmntr.sys','');
DeleteService('sbmntr');
SetServiceStart('storegidfilter', 4);
DeleteService('storegidfilter');
QuarantineFile('C:\Windows\storegidfilter.sys','');
DeleteFile('C:\Windows\storegidfilter.sys','32');
DeleteFile('C:\PROGRA~2\YTDOWN~1\sbmntr.sys','32');
DeleteFile('C:\Program Files (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.sys','32');
DeleteFile('C:\Windows\system32\drivers\{cca87299-eea0-4645-9629-a73bae49fd30}w64.sys','32');
DeleteFile('C:\Windows\system32\drivers\{bcaab8ad-c85a-4df0-833c-bb1e038f56cc}w64.sys','32');
DeleteFile('C:\Windows\system32\drivers\{6addfddb-ea1d-40a6-89d8-c21f55872f83}Gw64.sys','32');
DeleteFile('C:\Program Files (x86)\Kinoroom Browser\kinoroom-browser.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LoviVkontakte2','command');
DeleteFile('C:\Program Files (x86)\YTDownloader\YTDownloader.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','YTDownloader');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ZaxarLoader','command');
DeleteFile('C:\Program Files (x86)\Zaxar\ZaxarLoader.exe','32');
DeleteFile('C:\ProgramData\Kbupdater Utility\kbupdater-utility.exe','32');
DeleteFile('C:\Users\Раф\AppData\Local\ConvertAd\ConvertAd.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ConvertAd');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ConvertAd','command');
DeleteFile('C:\Users\Раф\AppData\Local\Microsoft\Extensions\safebrowser.exe','32');
DeleteFile('C:\Users\Раф\AppData\Local\storegid\storegid.exe','32');
DeleteFile('C:\Users\Раф\AppData\Roaming\eTranslator\eTranslator.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\aticonto','command');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','eTranslator Update');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\storegid','command');
DeleteFile('C:\Program Files (x86)\advPlugin\Toolbar32.dll','32');
DeleteFile('C:\Program Files (x86)\VK Downloader\Toolbar32.dll','32');
DeleteFile('C:\Program Files (x86)\Sense\Sense-codedownloader.exe','32');
DeleteFile('C:\Program Files (x86)\Sense\19cb93ae-e780-4a31-a04e-02c8330c663b-11.exe','32');
DeleteFile('C:\Program Files (x86)\Sense\19cb93ae-e780-4a31-a04e-02c8330c663b-2.exe','32');
DeleteFile('C:\Program Files (x86)\Sense\19cb93ae-e780-4a31-a04e-02c8330c663b-5.exe','32');
DeleteFile('C:\Program Files (x86)\Sense\19cb93ae-e780-4a31-a04e-02c8330c663b-6.exe','32');
DeleteFile('C:\Program Files (x86)\Sense\19cb93ae-e780-4a31-a04e-02c8330c663b-7.exe','32');
DeleteFile('C:\Program Files (x86)\Ge-Force\Ge-Force-codedownloader.exe','32');
DeleteFile('C:\Program Files (x86)\Ge-Force\9a55fd01-b13e-49f1-85a7-d864dc745d92-11.exe','32');
DeleteFile('C:\Program Files (x86)\Ge-Force\9a55fd01-b13e-49f1-85a7-d864dc745d92-2.exe','32');
DeleteFile('C:\Program Files (x86)\Ge-Force\9a55fd01-b13e-49f1-85a7-d864dc745d92-5.exe','32');
DeleteFile('C:\Program Files (x86)\Ge-Force\9a55fd01-b13e-49f1-85a7-d864dc745d92-6.exe','32');
DeleteFile('C:\Program Files (x86)\Ge-Force\9a55fd01-b13e-49f1-85a7-d864dc745d92-7.exe','32');
DeleteFile('C:\Users\Раф\AppData\Roaming\KMMZZPZR.exe','32');
DeleteFile('C:\Users\Раф\AppData\Roaming\newSI_604\s_inst.exe','32');
DeleteFile('C:\Users\Раф\AppData\Roaming\newSI_608\s_inst.exe','32');
DeleteFile('C:\Users\Раф\AppData\Roaming\newSI_611\s_inst.exe','32');
DeleteFile('C:\Users\Раф\AppData\Roaming\newSI_612\s_inst.exe','32');
DeleteFile('C:\Program Files (x86)\ver7SpeedCheck\y3SpeedCheckG56.exe','32');
DeleteFile('C:\Windows\Tasks\19cb93ae-e780-4a31-a04e-02c8330c663b-1.job','64');
DeleteFile('C:\Windows\Tasks\19cb93ae-e780-4a31-a04e-02c8330c663b-11.job','64');
DeleteFile('C:\Windows\Tasks\19cb93ae-e780-4a31-a04e-02c8330c663b-2.job','64');
DeleteFile('C:\Windows\Tasks\19cb93ae-e780-4a31-a04e-02c8330c663b-5.job','64');
DeleteFile('C:\Windows\Tasks\19cb93ae-e780-4a31-a04e-02c8330c663b-5_user.job','64');
DeleteFile('C:\Windows\Tasks\19cb93ae-e780-4a31-a04e-02c8330c663b-6.job','64');
DeleteFile('C:\Windows\Tasks\19cb93ae-e780-4a31-a04e-02c8330c663b-7.job','64');
DeleteFile('C:\Windows\Tasks\516c4660-8d41-4923-bc19-7addf95fbb40-1.job','64');
DeleteFile('C:\Windows\Tasks\516c4660-8d41-4923-bc19-7addf95fbb40-11.job','64');
DeleteFile('C:\Windows\Tasks\516c4660-8d41-4923-bc19-7addf95fbb40-2.job','64');
DeleteFile('C:\Windows\Tasks\516c4660-8d41-4923-bc19-7addf95fbb40-5.job','64');
DeleteFile('C:\Windows\Tasks\516c4660-8d41-4923-bc19-7addf95fbb40-5_user.job','64');
DeleteFile('C:\Windows\Tasks\516c4660-8d41-4923-bc19-7addf95fbb40-6.job','64');
DeleteFile('C:\Windows\Tasks\516c4660-8d41-4923-bc19-7addf95fbb40-7.job','64');
DeleteFile('C:\Windows\Tasks\9a55fd01-b13e-49f1-85a7-d864dc745d92-1.job','64');
DeleteFile('C:\Windows\Tasks\9a55fd01-b13e-49f1-85a7-d864dc745d92-11.job','64');
DeleteFile('C:\Windows\Tasks\9a55fd01-b13e-49f1-85a7-d864dc745d92-2.job','64');
DeleteFile('C:\Windows\Tasks\9a55fd01-b13e-49f1-85a7-d864dc745d92-5.job','64');
DeleteFile('C:\Windows\Tasks\9a55fd01-b13e-49f1-85a7-d864dc745d92-5_user.job','64');
DeleteFile('C:\Windows\Tasks\9a55fd01-b13e-49f1-85a7-d864dc745d92-6.job','64');
DeleteFile('C:\Windows\Tasks\9a55fd01-b13e-49f1-85a7-d864dc745d92-7.job','64');
DeleteFile('C:\Windows\Tasks\KMMZZPZR.job','64');
DeleteFile('C:\Windows\Tasks\newSI_604.job','64');
DeleteFile('C:\Windows\Tasks\newSI_608.job','64');
DeleteFile('C:\Windows\Tasks\newSI_611.job','64');
DeleteFile('C:\Windows\Tasks\newSI_612.job','64');
DeleteFile('C:\Windows\Tasks\SpeedCheck Update.job','64');
DeleteFile('C:\Windows\system32\Tasks\19cb93ae-e780-4a31-a04e-02c8330c663b-1','64');
DeleteFile('C:\Windows\system32\Tasks\19cb93ae-e780-4a31-a04e-02c8330c663b-11','64');
DeleteFile('C:\Windows\system32\Tasks\19cb93ae-e780-4a31-a04e-02c8330c663b-2','64');
DeleteFile('C:\Windows\system32\Tasks\19cb93ae-e780-4a31-a04e-02c8330c663b-5','64');
DeleteFile('C:\Windows\system32\Tasks\19cb93ae-e780-4a31-a04e-02c8330c663b-6','64');
DeleteFile('C:\Windows\system32\Tasks\19cb93ae-e780-4a31-a04e-02c8330c663b-7','64');
DeleteFile('C:\Windows\system32\Tasks\516c4660-8d41-4923-bc19-7addf95fbb40-1','64');
DeleteFile('C:\Windows\system32\Tasks\516c4660-8d41-4923-bc19-7addf95fbb40-11','64');
DeleteFile('C:\Windows\system32\Tasks\516c4660-8d41-4923-bc19-7addf95fbb40-2','64');
DeleteFile('C:\Windows\system32\Tasks\516c4660-8d41-4923-bc19-7addf95fbb40-5','64');
DeleteFile('C:\Windows\system32\Tasks\516c4660-8d41-4923-bc19-7addf95fbb40-6','64');
DeleteFile('C:\Windows\system32\Tasks\516c4660-8d41-4923-bc19-7addf95fbb40-7','64');
DeleteFile('C:\Windows\system32\Tasks\9a55fd01-b13e-49f1-85a7-d864dc745d92-1','64');
DeleteFile('C:\Windows\system32\Tasks\9a55fd01-b13e-49f1-85a7-d864dc745d92-11','64');
DeleteFile('C:\Windows\system32\Tasks\9a55fd01-b13e-49f1-85a7-d864dc745d92-2','64');
DeleteFile('C:\Windows\system32\Tasks\9a55fd01-b13e-49f1-85a7-d864dc745d92-5','64');
DeleteFile('C:\Windows\system32\Tasks\9a55fd01-b13e-49f1-85a7-d864dc745d92-6','64');
DeleteFile('C:\Windows\system32\Tasks\9a55fd01-b13e-49f1-85a7-d864dc745d92-7','64');
DeleteFile('C:\Users\Раф\AppData\Local\Microsoft\Extensions\extsetup.exe','32');
DeleteFile('C:\Windows\system32\Tasks\extsetup','64');
DeleteFile('C:\Windows\system32\Tasks\Kbupdater Utility','64');
DeleteFile('C:\Windows\system32\Tasks\newSI_604','64');
DeleteFile('C:\Windows\system32\Tasks\newSI_608','64');
DeleteFile('C:\Windows\system32\Tasks\newSI_611','64');
DeleteFile('C:\Windows\system32\Tasks\newSI_612','64');
DeleteFile('C:\Windows\system32\Tasks\PC Performer Logon Scan','64');
DeleteFile('C:\Windows\system32\Tasks\PC Performer Scheduled Scan','64');
DeleteFile('C:\Windows\system32\Tasks\Safebrowser','64');
DeleteFile('C:\Windows\system32\Tasks\ShopperPro','64');
DeleteFile('C:\Windows\system32\Tasks\ShopperProJSUpd','64');
DeleteFile('C:\Program Files (x86)\ShopperPro\ShopperPro.exe','32');
DeleteFile('C:\Program Files (x86)\ShopperPro\updater.exe','32');
DeleteFile('C:\Program Files (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.exe','32');
DeleteFile('C:\Windows\system32\Tasks\SPDriver','64');
DeleteFile('C:\Windows\system32\Tasks\SpeedCheck Update','64');
DeleteFile('C:\Windows\system32\Tasks\YTDownloader','64');
DeleteFile('C:\Windows\system32\Tasks\YTDownloaderUpd','64');
DeleteFile('C:\Program Files (x86)\YTDownloader\updater.exe','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.[/code]Компьютер перезагрузится.

Пришлите карантин согласно [B]Приложения 2[/B] правил по красной ссылке [COLOR="Red"][U][B]Прислать запрошенный карантин[/B][/U][/COLOR] вверху темы

Пофиксите в HiJack
[CODE]R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1420717000&from=obw&uid=WDCXWD10EZEX-08M2NA0_WD-WCC3FLPENCVRENCVR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://yamdex.net/?searchid=1&l10n=ru&fromsearch=1&imsid=b45bb4df864d7ec1c6e4a8e61f179e38&text={searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://yamdex.net/?searchid=1&l10n=ru&fromsearch=1&imsid=b45bb4df864d7ec1c6e4a8e61f179e38&text={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://2inf.net/?utm_source=startpage12
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1420717000&from=obw&uid=WDCXWD10EZEX-08M2NA0_WD-WCC3FLPENCVRENCVR
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1420717000&from=obw&uid=WDCXWD10EZEX-08M2NA0_WD-WCC3FLPENCVRENCVR&q={searchTerms}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1420717000&from=obw&uid=WDCXWD10EZEX-08M2NA0_WD-WCC3FLPENCVRENCVR&q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1420717000&from=obw&uid=WDCXWD10EZEX-08M2NA0_WD-WCC3FLPENCVRENCVR
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://istart.webssearches.com/web/?type=ds&ts=1420717000&from=obw&uid=WDCXWD10EZEX-08M2NA0_WD-WCC3FLPENCVRENCVR&q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://istart.webssearches.com/web/?type=ds&ts=1420717000&from=obw&uid=WDCXWD10EZEX-08M2NA0_WD-WCC3FLPENCVRENCVR&q={searchTerms}
O2 - BHO: (no name) - {0D5F364D-D6A9-43C1-BF0C-99B378972C5B} - (no file)
O2 - BHO: (no name) - {1B084C86-9657-42F9-A5E5-AC8DD832CDE9} - (no file)
O2 - BHO: advPlugin - {1FE48F08-A2AC-44AC-A21C-0556D91C50DA} - C:\Program Files (x86)\advPlugin\Toolbar32.dll (file missing)
O2 - BHO: (no name) - {319A461D-5202-4578-9EDC-CA35B9C0B561} - (no file)
O2 - BHO: VK Downloader - {3C6CF3C0-D800-4B4D-A3D8-8ADE406523B6} - C:\Program Files (x86)\VK Downloader\Toolbar32.dll (file missing)
O2 - BHO: Ads Removal - {9D974C8C-6D92-44FB-BEAF-B45A1C0CF17F} - C:\Program Files (x86)\IObit\Smart Defrag 3\adsremoval\IE\Adblock.dll (file missing)
O2 - BHO: Advanced SystemCare Surfing Protection - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\PROGRA~2\IObit\SURFIN~1\BROWER~1\ASCPLU~1.DLL (file missing)
O2 - BHO: (no name) - {D5FEC983-01DB-414A-9456-AF95AC9ED7B5} - (no file)
O4 - Startup: Safebrowser.lnk = ?
O13 - DefaultPrefix: http://yamdex.net/?searchid=1&l10n=ru&fromsearch=1&imsid=b45bb4df864d7ec1c6e4a8e61f179e38&text=[/CODE]

Сделайте новые логи

Сделайте лог [url="http://virusinfo.info/showthread.php?t=53070&p=1104657&viewfull=1#post1104657"]полного сканирования МВАМ[/url]