Стартовая страница в браузерах не меняется

Вложений: 2

После скачивание электронной книги, поймала кучу вирусов. Стали появляться всякие программы, браузеры Амиго, Комета и пр. После сканирование антивирусом, вроде все удалила, но во всех браузерах стала открываться стартовая страница yapages.ru и она никак не меняется, не смотря на настройки все равно открывается. Что делать?

Уважаемый(ая) [B]Emily[/B], спасибо за обращение на наш форум!

Удаление вирусов - абсолютно бесплатная услуга на VirusInfo.Info. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в [URL="http://virusinfo.info/pravila.html"]правилах оформления запроса о помощи[/URL].

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста [URL="http://virusinfo.info/content.php?r=113-virusinfo.info-donate"]поддержите проект[/URL].

[url="http://virusinfo.info/showthread.php?t=7239"]Выполните скрипт в AVZ[/url]:[code]begin
TerminateProcessByName('c:\users\pc\appdata\roaming\21cf5c00-1432798795-11b2-8000-9b3f66b91d9b\hnss6655.tmp');
SetServiceStart('rinizisu', 4);
StopService('rinizisu');
QuarantineFile('C:\Users\PC\appdata\local\microsoft\start menu\вoйти в интeрнeт.exe', '');
QuarantineFile('C:\Users\PC\appdata\local\kometa\kometaup.exe', '');
QuarantineFile('C:\Program Files (x86)\Common Files\Adobe\OOBA\PDApp\PPAPI\764693BB-CE80-4684-8F41-D1FB268C4711.exe', '');
QuarantineFile('C:\Users\PC\AppData\Roaming\J8B6tSX.exe', '');
QuarantineFile('C:\Users\PC\AppData\Roaming\gd2LPHwCnCPCIv.exe', '');
QuarantineFile('C:\ProgramData\LolliScan\LolliScan.exe', '');
QuarantineFile('C:\Users\PC\AppData\Roaming\Browsers\exe.resworb.bat', '');
QuarantineFile('C:\Users\PC\AppData\Roaming\Browsers\exe.erolpxei.bat', '');
QuarantineFile('C:\ProgramData\KRB Updater Utility\krbupdater-utility.exe', '');
QuarantineFile('c:\users\pc\appdata\roaming\21cf5c00-1432798795-11b2-8000-9b3f66b91d9b\hnss6655.tmp', '');
DeleteFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Tabs.lnk');
DeleteFile('C:\Users\PC\AppData\Roaming\21CF5C00-1432798795-11B2-8000-9B3F66B91D9B\hnss6655.tmp', '32');
DeleteFile('C:\Program Files (x86)\MiPony\MiPony.exe', '32');
DeleteFile('C:\ProgramData\KRB Updater Utility\krbupdater-utility.exe', '32');
DeleteFile('C:\Users\PC\AppData\Roaming\Browsers\exe.erolpxei.bat', '32');
DeleteFile('C:\Users\PC\AppData\Roaming\Browsers\exe.resworb.bat', '32');
DeleteFile('C:\windows\Tasks\APSnotifierPP1.job', '64');
DeleteFile('C:\windows\Tasks\APSnotifierPP2.job', '64');
DeleteFile('C:\windows\Tasks\APSnotifierPP3.job', '64');
DeleteFile('C:\ProgramData\LolliScan\LolliScan.exe', '32');
DeleteFile('C:\windows\Tasks\DTZQTVJK1.job', '64');
DeleteFile('C:\Users\PC\AppData\Roaming\gd2LPHwCnCPCIv.exe', '32');
DeleteFile('C:\windows\Tasks\gd2LPHwCnCPCIv.job', '64');
DeleteFile('C:\windows\Tasks\globalUpdateUpdateTaskMachineCore.job', '64');
DeleteFile('C:\windows\Tasks\globalUpdateUpdateTaskMachineUA.job', '64');
DeleteFile('C:\Users\PC\AppData\Roaming\J8B6tSX.exe', '32');
DeleteFile('C:\windows\Tasks\J8B6tSX.job', '64');
DeleteFile('C:\windows\Tasks\Price Fountain.job', '64');
DeleteFile('C:\windows\Tasks\SpeedUpMyPC.job', '64');
DeleteFile('C:\windows\Tasks\spmonitor.job', '64');
DeleteFile('C:\Program Files (x86)\Common Files\Adobe\OOBA\PDApp\PPAPI\764693BB-CE80-4684-8F41-D1FB268C4711.exe', '32');
DeleteFile('C:\Users\PC\appdata\local\kometa\kometaup.exe', '32');
DeleteFile('C:\Users\PC\appdata\local\microsoft\start menu\вoйти в интeрнeт.exe', '32');
DeleteService('wkdndjrh');
DeleteService('wkcaxyer');
DeleteService('wgyeybwo');
DeleteService('wgepjeja');
DeleteService('wgbbkcuv');
DeleteService('wdsjieoo');
DeleteService('vkccjtzt');
DeleteService('vhnlioui');
DeleteService('uzokxaph');
DeleteService('uxvdvrni');
DeleteService('usbnayze');
DeleteService('uichnjte');
DeleteService('tzqfmfoh');
DeleteService('twntunja');
DeleteService('tnzxzfvd');
DeleteService('tftghpua');
DeleteService('syycsmbg');
DeleteService('slytkspu');
DeleteService('scftzpgv');
DeleteService('sbuyljwv');
DeleteService('rkqrjlaz');
DeleteService('riodzixp');
DeleteService('rhkysueg');
DeleteService('renagqag');
DeleteService('qysndxns');
DeleteService('qwppriwr');
DeleteService('qrmoeobv');
DeleteService('qgtmnkzx');
DeleteService('qaoztdvj');
DeleteService('pytyuuht');
DeleteService('pwrtmlgq');
DeleteService('ptabtajp');
DeleteService('ppwuxhjg');
DeleteService('ouymaomi');
DeleteService('orawykzn');
DeleteService('oopwdkgl');
DeleteService('ojznffit');
DeleteService('ohkejcir');
DeleteService('ofunwuui');
DeleteService('oerxghyi');
DeleteService('oauikhce');
DeleteService('nvjggqgz');
DeleteService('nsqgdczj');
DeleteService('npstjwsh');
DeleteService('nmnbunhi');
DeleteService('nehjtqwn');
DeleteService('mwzvlmik');
DeleteService('mwrwznhl');
DeleteService('lsddbfjy');
DeleteService('lokvejcw');
DeleteService('llgpofwa');
DeleteService('ldkxspoo');
DeleteService('lbkcebvo');
DeleteService('kzkwdabf');
DeleteService('kzkmyblh');
DeleteService('kuncvfpa');
DeleteService('ktuagjwo');
DeleteService('krrxrseo');
DeleteService('kgsvzcaw');
DeleteService('jvjapzhj');
DeleteService('jvbfichy');
DeleteService('jpsqonjj');
DeleteService('jlbmemlu');
DeleteService('jburoiwh');
DeleteService('ixtbulgi');
DeleteService('ipboeqwx');
DeleteService('inyumchx');
DeleteService('innfd_1_10_0_14');
DeleteService('ijmmcahg');
DeleteService('igkjruqh');
DeleteService('ibqlouhx');
DeleteService('iazqkhqe');
DeleteService('hdqolpgc');
DeleteService('gufdyntr');
DeleteService('gnswbflk');
DeleteService('gfregnnd');
DeleteService('gfezmvnl');
DeleteService('gcvplnhb');
DeleteService('fzhshdqu');
DeleteService('fvymabjl');
DeleteService('fvuldswd');
DeleteService('fqrnzgha');
DeleteService('fojglnak');
DeleteService('fnsuqfmb');
DeleteService('femptsha');
DeleteService('ezdwgluq');
DeleteService('eygjxqeh');
DeleteService('eurvaish');
DeleteService('epkvydte');
DeleteService('ekmecjwu');
DeleteService('ejvtdjhq');
DeleteService('ejpsqcdj');
DeleteService('eikduqes');
DeleteService('ecnxanpa');
DeleteService('dsdmmydy');
DeleteService('dqcugteq');
DeleteService('dodyelzb');
DeleteService('dmtgaowq');
DeleteService('dieqwqqs');
DeleteService('dfqhidft');
DeleteService('cwjpubve');
DeleteService('cnpcccgj');
DeleteService('cktgsaoo');
DeleteService('cjvreofc');
DeleteService('bgqxdjpe');
DeleteService('bekgdavj');
DeleteService('axnpmgpr');
DeleteService('anwiftdg');
DeleteService('agegxjwc');
DeleteService('afuglzvs');
DeleteService('afretcgl');
DeleteService('aelmouyf');
DeleteService('adlnnqoy');
DeleteService('abkswctf');
DeleteService('rinizisu');
DeleteFileMask('C:\Users\PC\AppData\Roaming\21CF5C00-1432798795-11B2-8000-9B3F66B91D9B', '*', true);
DeleteFileMask('C:\Program Files (x86)\MiPony', '*', true);
DeleteFileMask('C:\ProgramData\KRB Updater Utility', '*', true);
DeleteFileMask('C:\ProgramData\LolliScan', '*', true);
DeleteFileMask('C:\Users\PC\appdata\local\kometa', '*', true);
DeleteDirectory('C:\Users\PC\AppData\Roaming\21CF5C00-1432798795-11B2-8000-9B3F66B91D9B');
DeleteDirectory('C:\Program Files (x86)\MiPony');
DeleteDirectory('C:\ProgramData\KRB Updater Utility');
DeleteDirectory('C:\ProgramData\LolliScan');
DeleteDirectory('C:\Users\PC\appdata\local\kometa');
DelBHO('{898EA8C8-E7FF-479B-8935-AEC46303B9E5}');
DelBHO('{fe704bf8-384b-44e1-8cf2-8dbeb3637a8a}');
DelBHO('{b608cc98-54de-4775-96c9-097de398500c}');
DelBHO('{01A13E40-2F55-4397-B39B-7851BCFB8008}');
ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP1" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP2" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP3" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "DTZQTVJK1" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "globalUpdateUpdateTaskMachineCore" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "globalUpdateUpdateTaskMachineUA" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "KRB Updater Utility" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "LaunchPreSignup" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Microsoft\Windows\AEEBC92EC-1A51-4610-9D5F-87376B0B276E" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Microsoft\Windows\EEBC92EC-1A51-4610-9D5F-87376B0B276E" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Microsoft\Windows\KRBUUS\KRB Updater Utility Service" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "SmartWeb Upgrade Trigger Task" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Soft installer" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "SpeedUpMyPC" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "spmonitor" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "{8C826B55-F043-442B-9B5F-76804C531AD4}" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "{90CEBFD8-B03A-4F39-BFE4-77B70214F243}" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "{F7F49819-1044-4F75-B8E1-55A6B44DE835}" /F', 0, 15000, true);
ExecuteSysClean;
ExecuteRepair(22);
ExecuteRepair(4);
ExecuteRepair(3);
ExecuteWizard('SCU', 2, 2, true);
RebootWindows(true);
end.[/code]Компьютер перезагрузится.
Выполните в AVZ скрипт:
[CODE]begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.[/CODE]
В папке с AVZ появится архив карантина quarantine.zip, отправьте этот файл по ссылке "Прислать запрошенный карантин" над над первым сообщением в теме.

Выполните 2-й стандартный скрипт в AVZ и прикрепите к своему следующему сообщению файл virusinfo_syscheck.zip.

Сделайте лог [URL="http://virusinfo.info/showthread.php?t=146192&p=1041844&viewfull=1#post1041844"]AdwCleaner (by Xplode)[/URL].
Сделайте лог [URL="http://virusinfo.info/soft/tool.php?tool=checkbrowserlnk"]Check Browsers' LNK[/URL].