Во время работы браузеров Гугл, Мозила меняется страница, устанавливаются Anyprotect и пр.

Откройте Блокнот (Старт =>Программы => Стандартные => Блокнот). Скопируйте в него следующий код:[CODE]CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\Run: [gmsd_ru_005010009] => [X]
HKLM-x32\...\Run: [gmsd_ru_008010010] => [X]
HKLM-x32\...\Run: [gmsd_ru_005010011] => C:\Program Files (x86)\gmsd_ru_005010011\gmsd_ru_005010011.exe [3981992 2015-06-23] ()
HKLM-x32\...\RunOnce: [upgmsd_ru_005010011.exe] => C:\Users\Никита\AppData\Local\gmsd_ru_005010011\upgmsd_ru_005010011.exe [3286184 2015-06-23] ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp&ts=1435164312&from=xtab&uid=8F1675033D72477398C8AA1082AE62B6
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp&ts=1435164312&from=xtab&uid=8F1675033D72477398C8AA1082AE62B6
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&ts=1435164312&from=xtab&uid=8F1675033D72477398C8AA1082AE62B6&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&ts=1435164312&from=xtab&uid=8F1675033D72477398C8AA1082AE62B6&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp&ts=1435164312&from=xtab&uid=8F1675033D72477398C8AA1082AE62B6
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp&ts=1435164312&from=xtab&uid=8F1675033D72477398C8AA1082AE62B6
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&ts=1435164312&from=xtab&uid=8F1675033D72477398C8AA1082AE62B6&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&ts=1435164312&from=xtab&uid=8F1675033D72477398C8AA1082AE62B6&q={searchTerms}
HKU\S-1-5-21-1396753628-3911374627-2909763291-1000\Software\Microsoft\Internet Explorer\Main,Start Page = ?type=hppp&ts=1435164312&from=xtab&uid=8F1675033D72477398C8AA1082AE62B6
URLSearchHook: HKLM-x32 - Default Value = {CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = web/?type=dspp&ts=1435164312&from=xtab&uid=8F1675033D72477398C8AA1082AE62B6&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = web/?type=dspp&ts=1435164312&from=xtab&uid=8F1675033D72477398C8AA1082AE62B6&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1396753628-3911374627-2909763291-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = web/?type=dspp&ts=1435164312&from=xtab&uid=8F1675033D72477398C8AA1082AE62B6&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1396753628-3911374627-2909763291-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = web/?type=dspp&ts=1435164312&from=xtab&uid=8F1675033D72477398C8AA1082AE62B6&q={searchTerms}
BHO-x32: LuckyTab Class -> {51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} -> C:\Program Files (x86)\MiuiTab\SupTab.dll [2015-06-16] (Thinknice Co. Limited)
Toolbar: HKU\S-1-5-21-1396753628-3911374627-2909763291-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DefaultPrefix-x32: => <==== ATTENTION
StartMenuInternet: IEXPLORE.EXE -
FF NewTab: hxxp://www.istartsurf.com/newtab/?type=nt&ts=1435157501&z=f09092add103b7d75f4cbcdgdzcc2w2gawbm1w8e8z&from=face&uid=WDCXWD10EZEX-60ZF5A0_WD-WCC1S571807318073
FF Homepage: ?type=hppp&ts=1435164312&from=xtab&uid=8F1675033D72477398C8AA1082AE62B6
FF user.js: detected! => C:\Users\Никита\AppData\Roaming\Mozilla\Firefox\Profiles\t8ktn5nz.default\user.js [2015-06-24]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\.xml [2015-06-24]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\istartsurf.xml [2015-06-24]
FF Extension: MegaSmiles - C:\Users\Никита\AppData\Roaming\Mozilla\Firefox\Profiles\t8ktn5nz.default\Extensions\[email protected] [2013-12-22]
FF Extension: Ge-Force - C:\Users\Никита\AppData\Roaming\Mozilla\Firefox\Profiles\t8ktn5nz.default\Extensions\[email protected] [2015-06-23]
StartMenuInternet: FIREFOX.EXE -
CHR HKLM-x32\...\Chrome\Extension: [mdeldjolamfbcgnndjmjjiinnhbnbnla] - http://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome -
StartMenuInternet: (HKLM) Opera -
R2 hitizyno; C:\Users\Никита\AppData\Roaming\03DE0294-1434975741-05BF-2806-BD0700080009\knsz4554.tmp [361984 2015-06-24] () [File not signed]
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [695976 2015-06-24] (DTools LIMITED) <==== ATTENTION
R2 IHProtect Service; C:\Program Files (x86)\MiuiTab\ProtectService.exe [125112 2015-06-16] (XTab system)
R1 innfd_1_10_0_14; system32\drivers\innfd_1_10_0_14.sys [X]
S1 wfd_1_10_0_19; system32\drivers\wfd_1_10_0_19.sys [X]
2015-06-24 18:17 - 2015-06-24 18:17 - 00613255 _____ (CMI Limited) C:\Users\Никита\AppData\Local\nsb85E1.tmp
2015-06-24 18:17 - 2015-06-24 18:17 - 00000000 __SHD C:\Users\Никита\AppData\Roaming\AnyProtectEx
2015-06-24 17:52 - 2015-06-24 19:45 - 00000000 ____D C:\Program Files (x86)\MiuiTab
2015-06-24 17:52 - 2015-06-24 17:55 - 00000000 ____D C:\Users\Никита\AppData\Local\gmsd_ru_005010011
2015-06-24 17:52 - 2015-06-24 17:52 - 00000000 ____D C:\Users\Никита\AppData\Roaming\istartsurf
2015-06-24 17:52 - 2015-06-24 17:52 - 00000000 ____D C:\Users\Все пользователи\WindowsMangerProtect
2015-06-24 17:52 - 2015-06-24 17:52 - 00000000 ____D C:\Users\Все пользователи\IHProtectUpDate
2015-06-24 17:52 - 2015-06-24 17:52 - 00000000 ____D C:\ProgramData\WindowsMangerProtect
2015-06-24 17:52 - 2015-06-24 17:52 - 00000000 ____D C:\ProgramData\IHProtectUpDate
2015-06-24 17:52 - 2015-06-24 17:52 - 00000000 ____D C:\Program Files (x86)\gmsd_ru_005010011
2015-06-24 17:51 - 2015-06-24 19:27 - 00000000 ____D C:\Users\Никита\AppData\Local\SmartWeb
2015-06-24 17:12 - 2015-06-24 17:12 - 00613255 _____ (CMI Limited) C:\Users\Никита\AppData\Local\nsm2F0A.tmp
2015-06-24 16:04 - 2015-06-24 16:04 - 00613255 _____ (CMI Limited) C:\Users\Никита\AppData\Local\nshABE4.tmp
2015-06-24 15:07 - 2015-06-24 15:07 - 00613255 _____ (CMI Limited) C:\Users\Никита\AppData\Local\nsx9857.tmp
2015-06-24 14:29 - 2015-06-24 14:29 - 00613255 _____ (CMI Limited) C:\Users\Никита\AppData\Local\nsr14A4.tmp
2015-06-24 10:52 - 2015-06-24 10:52 - 00613255 _____ (CMI Limited) C:\Users\Никита\AppData\Local\nswF42C.tmp
2015-06-24 01:57 - 2015-06-24 01:57 - 00613255 _____ (CMI Limited) C:\Users\Никита\AppData\Local\nsc378.tmp
2015-06-23 18:59 - 2015-06-23 18:59 - 00613255 _____ (CMI Limited) C:\Users\Никита\AppData\Local\nsc713B.tmp
2015-06-23 18:21 - 2015-06-23 18:21 - 00613255 _____ (CMI Limited) C:\Users\Никита\AppData\Local\nsc10ED.tmp
2015-06-23 14:20 - 2015-06-23 14:20 - 00613255 _____ (CMI Limited) C:\Users\Никита\AppData\Local\nsrAE7.tmp
2015-06-23 12:54 - 2015-06-23 12:54 - 00613255 _____ (CMI Limited) C:\Users\Никита\AppData\Local\nsr5CDD.tmp
2015-06-22 19:58 - 2015-06-22 19:58 - 00613255 _____ (CMI Limited) C:\Users\Никита\AppData\Local\nsiA820.tmp
2015-06-22 17:49 - 2015-06-22 17:49 - 00613255 _____ (CMI Limited) C:\Users\Никита\AppData\Local\nssB7AD.tmp
2015-06-22 17:47 - 2015-06-23 17:57 - 00000000 ____D C:\Users\Никита\AppData\Local\2094
2015-06-22 16:17 - 2015-06-22 16:17 - 00613255 _____ (CMI Limited) C:\Users\Никита\AppData\Local\nsj53E2.tmp
2015-06-22 16:02 - 2015-06-22 16:02 - 00243632 _____ C:\Users\Никита\Downloads\6419.tmp
2015-06-22 15:22 - 2015-06-24 19:20 - 00000000 ____D C:\Users\Никита\AppData\Roaming\03DE0294-1434975741-05BF-2806-BD0700080009
2015-06-22 15:22 - 2015-06-22 15:22 - 00000000 ____D C:\Users\Все пользователи\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
2015-06-22 15:22 - 2015-06-22 15:22 - 00000000 ____D C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
2015-06-22 15:21 - 2015-06-22 15:21 - 00000000 ____D C:\Users\Никита\AppData\Local\ExtensionInstaller_14
2015-06-22 15:20 - 2015-06-22 15:20 - 00000146 ____H C:\Users\Никита\AppData\Local\chrome.bat
2015-06-22 15:20 - 2015-06-22 15:20 - 00000102 ____H C:\iexplore.bat
2015-06-22 15:20 - 2015-06-22 15:20 - 00000101 ____H C:\firefox.bat
2015-06-22 15:20 - 2015-06-22 15:20 - 00000093 ____H C:\opera.bat
2015-06-22 15:20 - 2015-06-01 21:07 - 00815312 ____H (Microsoft Corporation) C:\iехplоrе.bаt.exe
2015-06-22 15:20 - 2015-04-17 18:30 - 00376944 ____H (Mozilla Corporation) C:\firеfох.bаt.exe
2015-06-22 15:20 - 2013-11-17 17:09 - 00879456 ____H (Opera Software) C:\оpеrа.bаt.exe
2015-06-22 15:20 - 2013-11-07 10:39 - 00779792 ____H (The Chromium Authors) C:\Users\Никита\AppData\Local\сhrоmе.bаt.exe
2015-04-19 15:20 - 2015-04-19 15:20 - 0005872 _____ () C:\Users\Никита\AppData\Roaming\Sf0rbBsP7cD
2015-04-20 17:05 - 2015-04-20 17:05 - 1579520 _____ () C:\Users\Никита\AppData\Roaming\Sf0rbBsP7cD.exe
2014-12-13 20:53 - 2014-12-18 15:09 - 0000641 _____ () C:\Users\Никита\AppData\Roaming\tlauncher.rmo.cfg
2014-12-13 20:52 - 2014-12-13 20:52 - 0000349 _____ () C:\Users\Никита\AppData\Roaming\tlauncher.rmo.ini
2015-04-14 19:28 - 2015-04-14 19:28 - 0004387 _____ () C:\Users\Никита\AppData\Roaming\V18SSW5CvSpx
2015-04-20 17:05 - 2015-04-20 17:05 - 1246720 _____ () C:\Users\Никита\AppData\Roaming\V18SSW5CvSpx.exe
2015-04-19 15:20 - 2015-04-19 15:20 - 0005872 _____ () C:\Users\Никита\AppData\Roaming\xG8VKW1DBjKwEZh2ds
2015-04-20 17:05 - 2015-04-20 17:05 - 1579520 _____ () C:\Users\Никита\AppData\Roaming\xG8VKW1DBjKwEZh2ds.exe
2015-04-19 15:20 - 2015-04-19 15:20 - 0005872 _____ () C:\Users\Никита\AppData\Roaming\z0Tfau1
2015-04-20 17:05 - 2015-04-20 17:05 - 1579520 _____ () C:\Users\Никита\AppData\Roaming\z0Tfau1.exe
2013-12-22 17:45 - 2013-12-22 17:45 - 0001131 _____ () C:\Users\Никита\AppData\Roaming\Войти в Интернет.lnk
2015-06-22 15:20 - 2015-06-22 15:20 - 0000146 ____H () C:\Users\Никита\AppData\Local\chrome.bat
globalupdate Helper (x32 Version: 1.3.25.0 - globalupdate Inc.) Hidden <==== ATTENTION
Task: {017665D3-728F-4B36-9040-C4D9167526A9} - System32\Tasks\{1BDA2741-9B54-404F-A7F7-2229862C4933} => Chrome.exe
Task: {0776291E-2A10-4078-ACEA-1B7552EB153E} - System32\Tasks\{34E13DAA-7A3E-4D2C-909E-3E4E0016A7A6} => pcalua.exe -a C:\Users\Никита\AppData\Roaming\istartsurf\UninstallManager.exe -c -ptid=face
Task: {0A74F7DD-79E9-4543-BFED-19BBAF0A5798} - System32\Tasks\{91272EF6-F96F-432F-9FF7-847FF9C03B81} => Chrome.exe
Task: {141E9C0E-CCD6-43AF-B2AB-20B52D07FE4A} - System32\Tasks\{9743E15A-87FB-4186-B784-753042D6A065} => Chrome.exe
Task: {6E4F9F66-FCD4-4B5D-B1C3-706A4366A8A3} - System32\Tasks\{B73C69B8-261C-408C-AEC0-49E438269C13} => Chrome.exe
Task: {7022E7F6-4C6B-4358-9FEB-A7BE424A7948} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {7C9D0AC3-8520-47F7-A088-519D4B365929} - System32\Tasks\{100A7682-709D-41EF-8FC1-B3813846A155} => Chrome.exe
Task: {961834C7-9FEA-45EC-BE95-E5E8D0FF5989} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {995F074A-DA6E-49AA-A0EB-DC553E703F5E} - System32\Tasks\ExtensionInstallerX_14 => C:\Users\Никита\local settings\application data\ExtensionInstaller_14\extinst.exe [2015-06-04] ()
Task: {AB0B08A8-1A52-46D4-9A0F-0020A127B2B3} - System32\Tasks\{C8F58456-3D73-41ED-B9D0-ED885F7ACB0C} => Chrome.exe
Task: {B94F8E09-6486-451B-9302-16539253DB5C} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {D7DEED6D-9D0A-49DA-8DE9-F47BE9659EE0} - System32\Tasks\{E599D9AE-2774-4916-9A42-9738BE022A9F} => pcalua.exe -a C:\Users\Никита\AppData\Roaming\omiga-plus\UninstallManager.exe -c -ptid=cor <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\Sf0rbBsP7cD.job => C:\Users\эяэяэяэяэяэя\AppData\Roaming\Sf0rbBsP7cD.exe <==== ATTENTION
Task: C:\Windows\Tasks\V18SSW5CvSpx.job => C:\Users\эяэяэяэяэяэя\AppData\Roaming\V18SSW5CvSpx.exe <==== ATTENTION
Task: C:\Windows\Tasks\xG8VKW1DBjKwEZh2ds.job => C:\Users\эяэяэяэяэяэя\AppData\Roaming\xG8VKW1DBjKwEZh2ds.exe <==== ATTENTION
Task: C:\Windows\Tasks\z0Tfau1.job => C:\Users\эяэяэяэяэяэя\AppData\Roaming\z0Tfau1.exe <==== ATTENTION
FirewallRules: [{C433CA96-1D78-46CB-958C-912DF973C964}] => (Allow) C:\program files (x86)\common files\baidu\bddownload\107\bddownloader.exe
InternetURL: C:\Users\Никита\AppData\Local\Xpom\Application\chrome.url -> hxxp://pwgamers.ru
InternetURL: C:\Users\Никита\AppData\Local\Xpom\Application\run_chrome.url -> hxxp://pwgamers.ru
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_ru_005010011_is1" /f
EmptyTemp:
Reboot:[/CODE]
и сохраните как fixlist.txt в папку с Farbar Recovery Scan Tool. [U]При сохранении выберите кодировку [B]Юникод[/B]![/U]
Отключите до перезагрузки антивирус, [U]закройте все браузеры[/U], запустите FRST, нажмите [B]Fix[/B] и подождите. Программа создаст лог-файл ([B]Fixlog.txt[/B]). Прикрепите его к своему следующему сообщению.
Компьютер будет перезагружен автоматически.

Сделайте логи AVZ и HijackThis по [URL="http://virusinfo.info/pravila.html"]правилам[/URL].

Сделайте лог [URL="http://dragokas.com/tools/CheckBrowsersLNK_dbg.zip"]Check Browsers' LNK by Dragokas & regist[/URL].