При нажатии на любом сайте на любую ссылку открываются новые окна с различными сайтами, пожалуйста помогите.
Printable View
При нажатии на любом сайте на любую ссылку открываются новые окна с различными сайтами, пожалуйста помогите.
Уважаемый(ая) [B]Yuudao[/B], спасибо за обращение на наш форум!
Удаление вирусов - абсолютно бесплатная услуга на VirusInfo.Info. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в [URL="http://virusinfo.info/pravila.html"]правилах оформления запроса о помощи[/URL].
Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста [URL="http://virusinfo.info/content.php?r=113-virusinfo.info-donate"]поддержите проект[/URL].
[url="http://virusinfo.info/showthread.php?t=7239"]Выполните скрипт в AVZ[/url]:[code]begin
ClearQuarantine;
TerminateProcessByName('c:\program files (x86)\application nation\bin\utilapplicationnation.exe');
TerminateProcessByName('c:\program files (x86)\application nation\updateapplicationnation.exe');
StopService('Util Application Nation');
StopService('Update Application Nation');
QuarantineFile('D:\games\Visual novel\SHEX-TSUKIPOS\HYOUIUS.EXE', '');
QuarantineFile('C:\Program Files (x86)\TNT2\2.0.0.1983\ietoolbar.dll', '');
QuarantineFile('c:\program files (x86)\application nation\bin\utilapplicationnation.exe', '');
QuarantineFile('c:\program files (x86)\application nation\updateapplicationnation.exe', '');
DeleteFile('c:\program files (x86)\application nation\updateapplicationnation.exe', '32');
DeleteFile('C:\Program Files (x86)\Application Nation\bin\utilApplicationNation.exe', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe', '32');
DeleteFile('C:\Users\Yuudai\AppData\Local\Amigo\Application\amigo.exe', '32');
DeleteFile('C:\Users\Yuudai\AppData\Local\Amigo\Application\ok.exe', '32');
DeleteFile('C:\Users\Yuudai\AppData\Local\Amigo\Application\vk.exe', '32');
DeleteFile('C:\Users\Yuudai\AppData\Local\SmartWeb\SmartWebHelper.exe', '32');
DeleteFile('C:\Program Files (x86)\TNT2\2.0.0.1983\ietoolbar.dll', '32');
DeleteFile('C:\Windows\Tasks\5e33840a-99da-48fa-ba99-315a062c8f7d-1-6.job', '64');
DeleteFile('C:\Windows\Tasks\5e33840a-99da-48fa-ba99-315a062c8f7d-1-7.job', '64');
DeleteFile('C:\Windows\Tasks\5e33840a-99da-48fa-ba99-315a062c8f7d-10_user.job', '64');
DeleteFile('C:\Windows\Tasks\5e33840a-99da-48fa-ba99-315a062c8f7d-11.job', '64');
DeleteFile('C:\Windows\Tasks\5e33840a-99da-48fa-ba99-315a062c8f7d-3.job', '64');
DeleteFile('C:\Windows\Tasks\5e33840a-99da-48fa-ba99-315a062c8f7d-5.job', '64');
DeleteFile('C:\Windows\Tasks\5e33840a-99da-48fa-ba99-315a062c8f7d-5_user.job', '64');
DeleteFile('C:\Windows\Tasks\5e33840a-99da-48fa-ba99-315a062c8f7d-6.job', '64');
DeleteFile('C:\Windows\Tasks\5e33840a-99da-48fa-ba99-315a062c8f7d-7.job', '64');
DeleteFile('C:\Windows\Tasks\APSnotifierPP1.job', '64');
DeleteFile('C:\Windows\Tasks\APSnotifierPP2.job', '64');
DeleteFile('C:\Windows\Tasks\APSnotifierPP3.job', '64');
DeleteFile('C:\Windows\Tasks\Crossbrowse.job', '64');
DeleteFile('C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job', '64');
DeleteFile('C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job', '64');
DeleteFile('C:\Windows\Tasks\ipPsT5CftEPujRZtnM.job', '64');
DeleteService('innfd_1_10_0_14');
DeleteService('kysykiti');
DeleteService('jokydeki');
DeleteService('insvc_1.10.0.14');
DeleteService('globalUpdatem');
DeleteService('globalUpdate');
DeleteFileMask('C:\Users\Yuudai\AppData\Local\SmartWeb', '*', true);
DeleteFileMask('C:\Program Files (x86)\TNT2', '*', true);
DeleteFileMask('C:\Users\Yuudai\AppData\Local\Amigo', '*', true);
DeleteFileMask('C:\Program Files (x86)\Crossbrowse', '*', true);
DeleteFileMask('c:\program files (x86)\application nation', '*', true);
DeleteDirectory('C:\Users\Yuudai\AppData\Local\SmartWeb');
DeleteDirectory('C:\Program Files (x86)\TNT2');
DeleteDirectory('C:\Users\Yuudai\AppData\Local\Amigo');
DeleteDirectory('C:\Program Files (x86)\Crossbrowse');
DeleteDirectory('c:\program files (x86)\application nation');
DelBHO('{64D1F7C0-C2B3-4976-A28D-18A42DCED6BE}');
DelBHO('{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}');
DelBHO('{0cd1caf7-a6fd-4c97-8f2f-8b5c3e2cf11e}');
ExecuteFile('schtasks.exe', '/delete /TN "5e33840a-99da-48fa-ba99-315a062c8f7d-1-6" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "5e33840a-99da-48fa-ba99-315a062c8f7d-1-7" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "5e33840a-99da-48fa-ba99-315a062c8f7d-11" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "5e33840a-99da-48fa-ba99-315a062c8f7d-3" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "5e33840a-99da-48fa-ba99-315a062c8f7d-5" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "5e33840a-99da-48fa-ba99-315a062c8f7d-6" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "5e33840a-99da-48fa-ba99-315a062c8f7d-7" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP1" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP2" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP3" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Crossbrowse" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "globalUpdateUpdateTaskMachineCore" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "globalUpdateUpdateTaskMachineUA" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "SmartWeb Upgrade Trigger Task" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "WdfHG" /F', 0, 15000, true);
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'ZaxarLoader');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'Timestasks');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'WinCheck');
ExecuteSysClean;
ExecuteRepair(4);
ExecuteRepair(3);
ExecuteWizard('SCU', 2, 2, true);
ExecuteWizard('TSW', 2, 2, true);
RebootWindows(true);
end.[/code]Компьютер перезагрузится.
Выполните в AVZ скрипт:
[CODE]begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.[/CODE]
В папке с AVZ появится архив карантина quarantine.zip, отправьте этот файл по ссылке "Прислать запрошенный карантин" над над первым сообщением в теме.
Выполните 2-й стандартный скрипт в AVZ и прикрепите к своему следующему сообщению файл virusinfo_syscheck.zip.
Сделайте лог [URL="http://virusinfo.info/showthread.php?t=146192&p=1041844&viewfull=1#post1041844"]AdwCleaner (by Xplode)[/URL].
Вот
[url="http://virusinfo.info/showthread.php?t=146192&p=1041864&viewfull=1#post1041864"]Удалите всё найденное в [B]AdwCleaner[/B][/URL], дождитесь окончания удаления и перезагрузите систему по требованию программы.
После входа в систему откроется отчёт AdwCleaner - файл AdwCleaner[S0].txt, прикрепите к своему следующему сообщению.
[URL="http://virusinfo.info/showthread.php?t=128635"]Очистите кэш и cookies-файлы браузеров[/URL] и сообщите, что с проблемами.
Вот
Что с рекламой?
Остался только 1 сайт с названием 69.16.175.42
Скачайте [URL="http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/"]Farbar Recovery Scan Tool[/URL] и сохраните на Рабочем столе.
Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.
Запустите программу. Когда программа запустится, нажмите Yes для соглашения с предупреждением.
Отметьте галочками также "Shortcut.txt".
Нажмите кнопку Scan.
После окончания сканирования будут созданы отчеты FRST.txt, Addition.txt, Shortcut.txt в той же папке, откуда была запущена программа.
Прикрепите эти файлы к своему следующему сообщению (можно все в одном архиве).
Вот
Откройте Блокнот (Старт =>Программы => Стандартные => Блокнот). Скопируйте в него следующий код:[CODE]CreateRestorePoint:
Toolbar: HKLM - FindWide Toolbar - {64D1F7C0-C2B3-4976-A28D-18A42DCED6BE} - C:\Program Files (x86)\TNT2\2.0.0.1983\IEToolbar64.dll No File
FF Plugin HKU\S-1-5-21-1862056126-479359179-347161627-1000: @tnt2npapi.com/Plugin -> C:\Users\Yuudai\AppData\Local\TNT2\2.0.0.1983\npTNT2.dll No File
CHR HKLM-x32\...\Chrome\Extension: [mfmjpfoggikolkfilofbpgcnhdcgahib] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pfjgibhmcgncmjhdodpaolfbjpjjajal] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pgaidlfgjkmeendhknafahppllbniejm] - https://clients2.google.com/service/update2/crx
OPR Extension: (CinemaPlus-4.5vV08.06) - C:\Users\Yuudai\AppData\Roaming\Opera Software\Opera Stable\Extensions\bfaohpmjmhdgnjblojekjlnadhehiadj [2015-06-09]
OPR Extension: (AdBlock) - C:\Users\Yuudai\AppData\Roaming\Opera Software\Opera Stable\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-06-09]
StartMenuInternet: (HKLM) OperaStable - C:\Program Files (x86)\Opera\Launcher.exe http://www.mystartsearch.com/?type=sc&ts=1433835955&z=8b3e6c28b0f1c2f23e482e7g3zec6c2bccewetdwbq&from=cmi&uid=WDCXWD1001FALS-00J7B1_WD-WMATV444461544615
2015-06-11 09:35 - 2015-06-11 09:35 - 00000000 ____D C:\ProgramData\boost_interprocess
FirewallRules: [{486D4849-3B83-4140-96FD-E9CB02789C11}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\tyunrf1t.smp\dcore.exe
FirewallRules: [{AD701609-B7F5-414D-853C-B88A32780A8E}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\tyunrf1t.smp\x64\m1.exe
FirewallRules: [{C33D248E-862B-4909-964E-F447F96A176A}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\tyunrf1t.smp\x64\c1.exe
FirewallRules: [{3E39B54A-4C75-4AF4-9DB6-7562871F5D75}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\tyunrf1t.smp\x86\c1.exe
FirewallRules: [{05BB4DA4-9501-4C7A-A451-974CB43FE171}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\tyunrf1t.smp\x86\m1.exe
FirewallRules: [{A877C9E8-EF2B-4538-B415-46817CB679B1}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\knark4q3.txi\x64\c1.exe
FirewallRules: [{58B18676-2F06-4415-A1B4-D784E2439B9A}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\knark4q3.txi\x86\m1.exe
FirewallRules: [{8F4DE25B-D3D2-41B0-96D1-237B157C2AC9}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\knark4q3.txi\dcore.exe
FirewallRules: [{D7F67CE8-EB51-4AEE-9E65-5F38209BDA37}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\knark4q3.txi\x86\c1.exe
FirewallRules: [{FFEC6B44-32C1-4184-98A4-BD5C18CE85EB}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\knark4q3.txi\x64\m1.exe
FirewallRules: [{DB136339-8FC8-463B-B11B-A872291B1D73}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\nmi3cuuv.eat\x86\c1.exe
FirewallRules: [{FBDCFF30-1E8A-4E1C-82DE-0B20A78A423A}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\nmi3cuuv.eat\x64\c1.exe
FirewallRules: [{FD806CA4-9D89-4D3F-ABB7-753C31CDA2F9}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\nmi3cuuv.eat\dcore.exe
FirewallRules: [{EA604625-D668-4D59-9EE3-492788A7E806}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\nmi3cuuv.eat\x86\m1.exe
FirewallRules: [{F9B27016-B03F-42FF-AE7E-F0D554369DCB}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\nmi3cuuv.eat\x64\m1.exe
FirewallRules: [{776612D7-AAA8-4007-9D13-B24D2EF59752}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\ygjxhpku.4pk\x64\m1.exe
FirewallRules: [{94430B8C-BAA7-47C7-9829-7A7968DD31F6}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\ygjxhpku.4pk\x64\c1.exe
FirewallRules: [{193ABCE2-8501-405D-8DE9-EA664EB06B7A}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\ygjxhpku.4pk\dcore.exe
FirewallRules: [{3AA3E990-6C81-4EAC-8AAE-142BB4AB0BD5}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\ygjxhpku.4pk\x86\c1.exe
FirewallRules: [{29F4E932-85C2-4107-94FA-588E35F7F7F6}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\ygjxhpku.4pk\x86\m1.exe
FirewallRules: [{4DA25606-D9BB-4B15-B8F4-E6103BB7CBDF}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\basou5ai.cch\dcore.exe
FirewallRules: [{E07AEDFA-3A53-431B-93FE-0F7940CB1AEF}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\basou5ai.cch\x86\c1.exe
FirewallRules: [{F3C3BD8B-C2ED-435D-AD8E-973BB36DB582}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\basou5ai.cch\x64\c1.exe
FirewallRules: [{5ABCBA0A-755E-4A0D-8DB1-41352897E286}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\basou5ai.cch\x64\m1.exe
FirewallRules: [{D4B5A1F6-42DC-4855-9982-4B5B40ED24D5}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\basou5ai.cch\x86\m1.exe
FirewallRules: [{CE6EB114-6826-49DA-905C-1D2FC2B9A33F}] => (Allow) C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe
FirewallRules: [{8023C324-B064-45AF-AD52-9A590B2DD627}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\2wyyfkeg.ztc\dcore.exe
FirewallRules: [{CD263715-025E-4CF0-8DA6-B3E82A07AB92}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\2wyyfkeg.ztc\x64\c1.exe
FirewallRules: [{EE0EE289-30EF-439A-8DAC-78C19B2C059B}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\2wyyfkeg.ztc\x86\c1.exe
FirewallRules: [{71120667-CB8F-444B-B9AE-B77D021A386E}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\2wyyfkeg.ztc\x64\m1.exe
FirewallRules: [{B9153E7D-4278-4DD1-A4EE-A8B4D3011443}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\2wyyfkeg.ztc\x86\m1.exe
FirewallRules: [{CEA8A033-2B26-4243-99A3-CA650533BB47}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\3mysudc1.mqt\dcore.exe
FirewallRules: [{D6355ACD-DEC1-4DDC-9704-9EDB8974079A}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\3mysudc1.mqt\x64\c1.exe
FirewallRules: [{331C5FF9-91D3-463C-A5A9-F243531307AE}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\3mysudc1.mqt\x64\m1.exe
FirewallRules: [{0351D224-44E3-44F7-B4F2-963FF908CC6A}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\3mysudc1.mqt\x86\m1.exe
FirewallRules: [{182DA551-B4B4-4744-9CD5-D431AB5C1549}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\3mysudc1.mqt\x86\c1.exe
FirewallRules: [{C9CC53DE-8A3B-4C7E-8665-951AA15E43D8}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\aga4ay4i.rj2\x86\c1.exe
FirewallRules: [{41B8A980-386E-4D8B-AD32-27695C49C297}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\aga4ay4i.rj2\dcore.exe
FirewallRules: [{EA232850-C315-4908-A8C2-31386AFAE8BE}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\aga4ay4i.rj2\x86\m1.exe
FirewallRules: [{93FC7B97-70D1-4FFA-B60F-D3E093D75D77}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\aga4ay4i.rj2\x64\m1.exe
FirewallRules: [{734A91A6-E859-40D7-A8BC-0B4B6954FD2F}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\aga4ay4i.rj2\x64\c1.exe
FirewallRules: [{5099AF83-D608-47F1-B92A-BA8CBD7BA2A3}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\0qt2vwxy.q4b\dcore.exe
FirewallRules: [{1BB41023-EEF3-48A4-9601-5647C396A704}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\0qt2vwxy.q4b\x64\c1.exe
FirewallRules: [{69803591-787C-4273-B8B5-29DD501616A7}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\0qt2vwxy.q4b\x64\m1.exe
FirewallRules: [{AA9A5AFD-714A-46C0-AEE5-89D60B90048B}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\0qt2vwxy.q4b\x86\c1.exe
FirewallRules: [{0B4C7B8E-CB76-4204-B2E8-E81E1A525B5B}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\0qt2vwxy.q4b\x86\m1.exe
FirewallRules: [{526091C6-B09A-44AC-94CF-25698791B9F7}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\uc4bifhx.fzj\dcore.exe
FirewallRules: [{510761F4-1A66-4121-8CB7-CF7B38BAF655}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\uc4bifhx.fzj\x64\m1.exe
FirewallRules: [{CB94648B-DEF3-4C68-960A-C4689E9036C9}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\uc4bifhx.fzj\x64\c1.exe
FirewallRules: [{D39DB0E3-B0EB-4502-82FC-C99C2CBA5B72}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\uc4bifhx.fzj\x86\c1.exe
FirewallRules: [{25EC5B31-E1B8-4673-AACB-FC9418D7A5E0}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\uc4bifhx.fzj\x86\m1.exe
FirewallRules: [{C64BA3D5-6B04-4067-A925-EF9F374FB792}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\0yps15vm.noi\dcore.exe
FirewallRules: [{21BE1C31-E0A5-48A6-88DC-A0E4DA00023E}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\0yps15vm.noi\x64\m1.exe
FirewallRules: [{4407CD96-915E-48BE-84DB-89CF3EBABA5F}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\0yps15vm.noi\x64\c1.exe
FirewallRules: [{38A6322F-FF95-40FB-9E9B-7C6D4ABF3BD9}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\0yps15vm.noi\x86\m1.exe
FirewallRules: [{7497CD67-1DCD-4E57-901F-FFC1A63DC2AF}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\0yps15vm.noi\x86\c1.exe
FirewallRules: [{A07CEE4A-EFAB-41FE-AAF9-340DA458FEE3}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\mqxmjld0.a1g\x64\c1.exe
FirewallRules: [{072871D7-4587-4E06-94A2-97998CEE03C4}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\mqxmjld0.a1g\dcore.exe
FirewallRules: [{6BAA6D82-50E2-469C-85F5-E68ECA7ED89A}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\mqxmjld0.a1g\x64\m1.exe
FirewallRules: [{967A2092-E410-40EC-B572-3F6DD461860C}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\mqxmjld0.a1g\x86\c1.exe
FirewallRules: [{6BF6D083-0917-4E9F-84B0-56BD128FBADE}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\mqxmjld0.a1g\x86\m1.exe
FirewallRules: [{AA8C2677-18AA-4F0C-8705-EB6C44B583F7}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\3htymutq.aod\dcore.exe
FirewallRules: [{B7BC8CAF-9D6C-4101-B60D-E93DA76BB6DB}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\3htymutq.aod\x64\m1.exe
FirewallRules: [{97857984-D4C3-4EAB-BEB4-2B70A2AEF192}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\3htymutq.aod\x86\c1.exe
FirewallRules: [{CD142E46-36A1-45EB-8CC3-4656FC6B629C}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\3htymutq.aod\x64\c1.exe
FirewallRules: [{62E82976-B015-41FC-A476-D54DCF222A8A}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\3htymutq.aod\x86\m1.exe
FirewallRules: [{8C6D4C40-3C16-45A2-AAC2-DC6C3A10C0E0}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\rfrugqm0.ec1\x64\m1.exe
FirewallRules: [{5D695366-DF0A-43B1-A03E-EF040690F119}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\rfrugqm0.ec1\x64\c1.exe
FirewallRules: [{92C67025-8BB7-49D1-BB54-D27AD51F0EF3}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\rfrugqm0.ec1\dcore.exe
FirewallRules: [{A1BC3872-2FFA-4535-9335-B4546E20291D}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\rfrugqm0.ec1\x86\c1.exe
FirewallRules: [{EAD6CA39-6FC4-40E6-9905-A76A5ED4234E}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\rfrugqm0.ec1\x86\m1.exe
FirewallRules: [{6FCC5EB0-5B9D-413F-9853-40D9BEA2E575}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\kblh1zw2.aus\x64\c1.exe
FirewallRules: [{86AEA926-5032-4AE0-B612-E89590042050}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\kblh1zw2.aus\x86\m1.exe
FirewallRules: [{08BE888F-522A-4E60-9C08-5683B8EE08A4}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\kblh1zw2.aus\dcore.exe
FirewallRules: [{F59A9301-6093-4435-8DF2-7AE436CA8941}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\kblh1zw2.aus\x64\m1.exe
FirewallRules: [{F7B7E425-58BA-4E07-9161-464B3C705E8A}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\kblh1zw2.aus\x86\c1.exe
FirewallRules: [{BC78E744-E25A-482D-A2EA-11BA34CC17C9}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\m40jl4wz.zdd\dcore.exe
FirewallRules: [{94DF1D09-7C04-4E99-8F88-8E5DBBEB3DB4}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\m40jl4wz.zdd\x64\c1.exe
FirewallRules: [{8AF8C540-A43C-4B84-B306-FCFB77F543EA}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\m40jl4wz.zdd\x64\m1.exe
FirewallRules: [{565FDBAB-2658-425A-959B-59F231BD2D9A}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\m40jl4wz.zdd\x86\c1.exe
FirewallRules: [{C1FE1315-9F7E-4731-8A9E-27A1FA8129AD}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\m40jl4wz.zdd\x86\m1.exe
FirewallRules: [{F1D18943-F882-4290-99D0-CE3A4C2167F4}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\c2s4keqr.5uk\dcore.exe
FirewallRules: [{E7FA6F95-CC9D-4B32-B7EA-C2AAF54FC742}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\c2s4keqr.5uk\x64\c1.exe
FirewallRules: [{127A5A75-771C-419C-82C6-BB32F2428939}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\c2s4keqr.5uk\x86\c1.exe
FirewallRules: [{34E2E05F-85AE-436E-8F29-BA090AC5CF56}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\c2s4keqr.5uk\x64\m1.exe
FirewallRules: [{6E52D3A7-0C8A-4B65-9423-C6DA916E79A2}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\c2s4keqr.5uk\x86\m1.exe
FirewallRules: [{480AAB10-B112-43F3-88F3-94759D3AB7DA}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\olc54cwd.f1i\dcore.exe
FirewallRules: [{2B7FA115-D664-403A-A819-153575DF524D}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\olc54cwd.f1i\x64\c1.exe
FirewallRules: [{CF96C597-31D6-4390-8A84-690496CF8801}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\olc54cwd.f1i\x64\m1.exe
FirewallRules: [{64BE8BAA-86CE-4BE2-B760-752094A04B2F}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\olc54cwd.f1i\x86\c1.exe
FirewallRules: [{818C6669-AD52-41E8-BAF0-143ACC3975C4}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\olc54cwd.f1i\x86\m1.exe
FirewallRules: [{ED3EA434-C794-4B0A-9A8A-23024C2A24C5}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\un1m2a2v.3ap\dcore.exe
FirewallRules: [{0FF18277-2C3E-4399-A0F4-202A5F15522D}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\un1m2a2v.3ap\x64\m1.exe
FirewallRules: [{BF6E087D-02CB-4673-8003-C83BC2A89FC7}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\un1m2a2v.3ap\x86\c1.exe
FirewallRules: [{58613012-1F84-441A-B624-9C075F8F6BB5}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\un1m2a2v.3ap\x64\c1.exe
FirewallRules: [{40003906-A1DA-4B88-8435-0FDD8239FCB9}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\un1m2a2v.3ap\x86\m1.exe
FirewallRules: [{F08C7E0A-D9B0-4EA5-A064-5D2CC4BAF3D0}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\xgnctvpr.poi\dcore.exe
FirewallRules: [{8D3C4C75-D759-4191-B86A-03B25C9DF31A}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\xgnctvpr.poi\x64\m1.exe
FirewallRules: [{3F97E47F-FB3C-4E96-A379-C45C5E80E3E2}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\xgnctvpr.poi\x86\m1.exe
FirewallRules: [{E2C848C5-CD33-4053-B6CD-1098261A770A}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\xgnctvpr.poi\x64\c1.exe
FirewallRules: [{91E219E3-AC0B-4888-A093-BFFBA3B2F869}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\xgnctvpr.poi\x86\c1.exe
FirewallRules: [{B0BA4EB9-B7E9-49C7-A4A7-E6F3DF224A51}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\ryscl5ix.qbf\dcore.exe
FirewallRules: [{E59DFBAC-C90E-428A-B5D0-58F30192C012}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\ryscl5ix.qbf\x64\c1.exe
FirewallRules: [{6CC5AD77-303F-4C8C-859A-D6F86A1641BF}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\ryscl5ix.qbf\x64\m1.exe
FirewallRules: [{204D4390-109A-4108-A315-C35F2041D194}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\ryscl5ix.qbf\x86\c1.exe
FirewallRules: [{E941BD65-4679-459E-99EB-B08534515E27}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\ryscl5ix.qbf\x86\m1.exe
FirewallRules: [{615E8417-3749-4DD2-99A5-8078F30721B9}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\yzwjddet.uvd\dcore.exe
FirewallRules: [{DE55735E-1DEE-4E82-839A-53927B26A292}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\yzwjddet.uvd\x64\c1.exe
FirewallRules: [{227BFD45-17DE-498E-88F9-61EA61932F0C}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\yzwjddet.uvd\x64\m1.exe
FirewallRules: [{9DE34BFC-C780-47E3-8607-060A9F228588}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\yzwjddet.uvd\x86\c1.exe
FirewallRules: [{0E181402-FB49-47F2-8F64-0104BB3AEB53}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\yzwjddet.uvd\x86\m1.exe
FirewallRules: [{F5A59FB1-6338-4F42-BFAD-D867BEAF4C17}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\z24eaadn.q5s\dcore.exe
FirewallRules: [{28473F82-4E4F-46A9-A348-984004BE3535}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\z24eaadn.q5s\x64\m1.exe
FirewallRules: [{C279F142-78B2-4634-B7CE-A274F9E50F40}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\z24eaadn.q5s\x64\c1.exe
FirewallRules: [{B2F40992-A3E5-47F3-A6C6-30FCD9176A20}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\z24eaadn.q5s\x86\c1.exe
FirewallRules: [{C2D0562D-5AEC-42CA-BE3C-A7ABAD8FEB4F}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\z24eaadn.q5s\x86\m1.exe
FirewallRules: [{E1076CE8-51B1-4851-A15E-663650EF4655}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\sret3411.dvb\dcore.exe
FirewallRules: [{0E7160B1-ACA4-405E-A4BF-812F73D482A0}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\sret3411.dvb\x86\c1.exe
FirewallRules: [{74D0B97A-1AA2-43DA-9079-8C0973FFF1B2}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\sret3411.dvb\x64\c1.exe
FirewallRules: [{E39196C1-71F2-416A-BA6A-4EC24D028C13}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\sret3411.dvb\x64\m1.exe
FirewallRules: [{ADA0EAC3-B7C7-49DB-A931-49FED4EAF669}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\sret3411.dvb\x86\m1.exe
FirewallRules: [{FBDBA9C1-E07E-4AE8-80DF-E65BC56DB882}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\v1omdz2x.ao2\dcore.exe
FirewallRules: [{61289353-6E15-4623-8DB9-FCF3104C6801}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\v1omdz2x.ao2\x64\c1.exe
FirewallRules: [{778474D0-A725-4433-A387-AEF17C2A8B2A}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\v1omdz2x.ao2\x64\m1.exe
FirewallRules: [{3BA73715-D0FE-49F8-ACB3-60DD65A986DA}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\v1omdz2x.ao2\x86\c1.exe
FirewallRules: [{42AD80FB-9C73-4D8E-A156-C57C42DFD76A}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\v1omdz2x.ao2\x86\m1.exe
FirewallRules: [{A7BB548E-162D-4A46-8A6C-42C5FFEEC5FC}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\4xdzwmp5.5ll\dcore.exe
FirewallRules: [{438B147B-8AEC-4FC8-BE6A-769C5AF5678E}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\4xdzwmp5.5ll\x64\m1.exe
FirewallRules: [{CC1E35A8-886E-4CA9-A674-040AFE87107C}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\4xdzwmp5.5ll\x64\c1.exe
FirewallRules: [{7EAA563A-BE81-4BD3-B219-80E81F29B2F3}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\4xdzwmp5.5ll\x86\c1.exe
FirewallRules: [{258CC575-DE66-40FA-84E5-20D999917687}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\4xdzwmp5.5ll\x86\m1.exe
FirewallRules: [{7E929011-B324-4C10-991D-3486995654B5}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\jzrntat2.cvx\dcore.exe
FirewallRules: [{3AF561FB-5C8B-4BFC-AF2B-0AE7A6878657}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\jzrntat2.cvx\x64\m1.exe
FirewallRules: [{E2721C63-70B0-4793-BA32-EC23E5AFABF4}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\jzrntat2.cvx\x64\c1.exe
FirewallRules: [{7E3F2CC9-F51B-444D-8E3A-6B91824693F6}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\jzrntat2.cvx\x86\m1.exe
FirewallRules: [{BC1C647F-20C2-444C-820B-F24C163BED77}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\jzrntat2.cvx\x86\c1.exe
FirewallRules: [{073EF4FA-5CA8-436B-A106-EB844B255A9D}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\ptl0x2bp.v13\dcore.exe
FirewallRules: [{D340DD69-E193-4DA6-880F-7637BE472383}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\ptl0x2bp.v13\x64\c1.exe
FirewallRules: [{8D6E5317-7A53-4A72-86E8-CA75DD430D0E}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\ptl0x2bp.v13\x86\c1.exe
FirewallRules: [{5573A004-618C-4953-857B-1C0F39350221}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\ptl0x2bp.v13\x64\m1.exe
FirewallRules: [{CAFC80BD-3374-4001-8C6D-AD0397EB5E47}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\ptl0x2bp.v13\x86\m1.exe
FirewallRules: [{DD4AE109-73A4-4360-A70B-D9DA0E0B9857}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\5xqb2az0.cx5\dcore.exe
FirewallRules: [{0097A0E5-7D81-4070-BBA9-701FF4765BE6}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\5xqb2az0.cx5\x64\c1.exe
FirewallRules: [{ABCF16DC-703B-406F-9AA5-EA7D1814E32F}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\5xqb2az0.cx5\x64\m1.exe
FirewallRules: [{B0858EB1-DFE1-4BE2-80B2-BD452A253BA5}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\5xqb2az0.cx5\x86\c1.exe
FirewallRules: [{58079A7B-357F-4E95-8A26-8EA4A1EE06DE}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\5xqb2az0.cx5\x86\m1.exe
FirewallRules: [{1725982F-B8A8-49CE-B8D7-1386A8907506}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\qx4apj3r.sqe\dcore.exe
FirewallRules: [{69554124-E6F5-4F74-8B5B-63CC9D04612F}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\qx4apj3r.sqe\x64\c1.exe
FirewallRules: [{84771CD8-6636-41E9-868F-8DDBC7617038}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\qx4apj3r.sqe\x64\m1.exe
FirewallRules: [{90419197-3C4C-4503-AD60-BB5D63029EC1}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\qx4apj3r.sqe\x86\c1.exe
FirewallRules: [{E0E25C49-6B6C-4A73-87DD-6D7F35DB3072}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\qx4apj3r.sqe\x86\m1.exe
FirewallRules: [{3B483E1B-6E65-4448-82B4-F47D95C4BDAD}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\xstjiswd.jka\x86\c1.exe
FirewallRules: [{0A6507DB-2BA6-4C3F-8D9D-F3CBB74B1548}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\xstjiswd.jka\x64\m1.exe
FirewallRules: [{00BB553D-845D-4A7B-B20C-E31277269FED}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\xstjiswd.jka\x86\m1.exe
FirewallRules: [{D119A7B3-2444-4A5C-8952-D92661A47F32}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\xstjiswd.jka\x64\c1.exe
FirewallRules: [{93A8D0BD-096B-4750-AF5A-8FEF567964E5}] => (Allow) C:\Users\Yuudai\AppData\Local\Temp\xstjiswd.jka\dcore.exe
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Application Nation" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CinemaPlus-4.5vV08.06" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Infonaut 1.10.0.14" /f
Reg: reg delete "HKU\S-1-5-21-1862056126-479359179-347161627-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\Time tasks" /f
Reg: reg delete "HKU\S-1-5-21-1862056126-479359179-347161627-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\Амиго" /f
EmptyTemp:
Reboot:[/CODE]
и сохраните как fixlist.txt в папку с Farbar Recovery Scan Tool. [U]При сохранении выберите кодировку [B]Юникод[/B]![/U]
Отключите до перезагрузки антивирус, [U]закройте все браузеры[/U], запустите FRST, нажмите [B]Fix[/B] и подождите. Программа создаст лог-файл ([B]Fixlog.txt[/B]). Прикрепите его к своему следующему сообщению.
Компьютер будет перезагружен автоматически.
Сообщите, что с проблемой.
Слетели автологины, за 10 минут пользования Opera ничего не наблюдалось. Надеюсь помогло.
Удалите папку C:\FRST со всем содержимым.
Запустите AdwCleaner и нажмите [B]Удалить[/B].
Выполните [url="http://virusinfo.info/showthread.php?t=121902"]рекомендации после лечения[/url].
Сейчас всё работает отлично, спасибо большое!
Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]1[/B][*]Обработано файлов: [B]4[/B][*]В ходе лечения вредоносные программы в карантинах не обнаружены[/LIST]