Самоустанавливающиеся программы, реклама, проблемы с Chrome [Trojan-Downloader.Win32.Genome.tlkc, not-a-virus:AdWare.Win32.ConvertAd.awz ]

Приветствую, прошу помочь знающих. Младший брат по своей тупости забрел на один из рекламных сайтов. В связи с этим появились: левые браузеры( Opera, Амиго), проблемы с Google Chrome( удалился, при повторной установке поисковик на Google не меняется, а со временем сам браузер заменяется поверх другим браузером), не удаляются пару ярлыков-дубликатов программ(ссылаются на то, что открыты в другой программе), самоустанавливающиеся программы(удалял несколько, на их место приходят новые, число растет), реклама на сайтах. Ну и не говоря об общей тормознутости компьютера. Помогите пожалуйста, заранее благодарю за отзыв

Уважаемый(ая) [B]Vnike007[/B], спасибо за обращение на наш форум!

Помощь при заражении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы, в самое ближайшее время, ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в [URL="http://virusinfo.info/pravila.html"]правилах оформления запроса о помощи[/URL].

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста [URL="http://virusinfo.info/content.php?r=113-virusinfo.info-donate"]поддержите проект[/URL].

Выполните скрипт в AVZ
[code]begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
QuarantineFile('C:\Users\пользователь\appdata\local\smartweb\__u.exe','');
QuarantineFile('C:\Program Files (x86)\YTDownloader\updater.exe','');
QuarantineFile('C:\Program Files (x86)\YTDownloader\YTDownloader.exe','');
QuarantineFile('C:\Program Files (x86)\WordSurfer_1.10.0.19\Update\WordSurferAutoUpdateClient.exe','');
QuarantineFile('C:\Program Files (x86)\WordShark_1.10.0.20\Update\WordSharkAutoUpdateClient.exe','');
QuarantineFile('C:\Users\пользователь\AppData\Roaming\WindowsUpdater\Updater.exe','');
QuarantineFile('C:\Program Files (x86)\Microsoft Data\install_addons.exe','');
QuarantineFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-5.exe','');
QuarantineFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-6.exe','');
QuarantineFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-7.exe','');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe','');
QuarantineFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-3.exe','');
QuarantineFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-11.exe','');
QuarantineFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-10.exe','');
QuarantineFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-1-7.exe','');
QuarantineFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-1-6.exe','');
QuarantineFile('C:\Program Files (x86)\Shop and Save Up\b3b23845-23db-4d7f-bb0a-d6a24433715e-7.exe','');
QuarantineFile('C:\Program Files (x86)\Shop and Save Up\b3b23845-23db-4d7f-bb0a-d6a24433715e-6.exe','');
QuarantineFile('C:\Program Files (x86)\Shop and Save Up\b3b23845-23db-4d7f-bb0a-d6a24433715e-1-6.exe','');
QuarantineFile('C:\Program Files (x86)\Shop and Save Up\b3b23845-23db-4d7f-bb0a-d6a24433715e-1-7.exe','');
QuarantineFile('C:\Program Files (x86)\Shop and Save Up\b3b23845-23db-4d7f-bb0a-d6a24433715e-10.exe','');
QuarantineFile('C:\Program Files (x86)\Shop and Save Up\b3b23845-23db-4d7f-bb0a-d6a24433715e-3.exe','');
QuarantineFile('C:\Program Files (x86)\Shop and Save Up\b3b23845-23db-4d7f-bb0a-d6a24433715e-5.exe','');
QuarantineFile('C:\Users\пользователь\AppData\Local\30337\Updater.exe','');
QuarantineFile('C:\Program Files (x86)\Object Browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-1-6.exe','');
QuarantineFile('C:\Program Files (x86)\Object Browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-1-7.exe','');
QuarantineFile('C:\Program Files (x86)\Object Browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-5.exe','');
QuarantineFile('C:\Program Files (x86)\Object Browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-6.exe','');
QuarantineFile('C:\Program Files (x86)\Object Browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-7.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-7.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-6.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-5.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-3.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-10.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-1-7.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-1-6.exe','');
QuarantineFile('C:\Program Files (x86)\iWebar\006d49aa-efdd-4047-9bd3-2df305130d81-7.exe','');
QuarantineFile('C:\Program Files (x86)\iWebar\006d49aa-efdd-4047-9bd3-2df305130d81-6.exe','');
QuarantineFile('C:\Program Files (x86)\iWebar\006d49aa-efdd-4047-9bd3-2df305130d81-5.exe','');
QuarantineFile('C:\Program Files (x86)\iWebar\006d49aa-efdd-4047-9bd3-2df305130d81-1-7.exe','');
QuarantineFile('C:\Program Files (x86)\iWebar\006d49aa-efdd-4047-9bd3-2df305130d81-1-6.exe','');
DelBHO('{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}');
DelBHO('{b7f975e4-2467-475f-9cfd-994f39ab5bb5}');
QuarantineFile('C:\IQIYI Video\Common\Accelerator\IEHelper.dll','');
QuarantineFile('C:\Program Files (x86)\Coupon Time\CouponTimebho.dll','');
QuarantineFile('C:\Users\пользователь\AppData\Roaming\cpuminer\sgminer\sgminer.cmd','');
QuarantineFile('C:\Users\пользователь\AppData\Roaming\Browsers\exe.erolpxei.bat','');
QuarantineFile('C:\PROGRA~2\SupTab\SEARCH~2.DLL','');
QuarantineFile('C:\PROGRA~2\SupTab\SEARCH~1.DLL','');
QuarantineFile('C:\IQIYI Video\Common\QyKernel.exe','');
SetServiceStart('wsfd_vt_1_10_0_20', 4);
DeleteService('wsfd_vt_1_10_0_20');
SetServiceStart('wsafd_1_10_0_19', 4);
DeleteService('wsafd_1_10_0_19');
SetServiceStart('sysmon', 4);
DeleteService('sysmon');
SetServiceStart('sbmntr', 4);
DeleteService('sbmntr');
SetServiceStart('rsutils', 4);
DeleteService('rsutils');
DeleteService('RsRavMon');
DeleteService('RsMgrSvc');
DeleteService('globalUpdatem');
DeleteService('globalUpdate');
QuarantineFile('C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe','');
SetServiceStart('wssvc_1.10.0.20', 4);
DeleteService('wssvc_1.10.0.20');
SetServiceStart('vicoqudu', 4);
DeleteService('vicoqudu');
SetServiceStart('Util Coupon Time', 4);
DeleteService('Util Coupon Time');
SetServiceStart('Update Coupon Time', 4);
DeleteService('Update Coupon Time');
QuarantineFile('C:\Program Files\netfilter\PFHttpContentFilter.exe','');
SetServiceStart('guqiwego', 4);
DeleteService('guqiwego');
SetServiceStart('gopibeko', 4);
DeleteService('gopibeko');
SetServiceStart('BrsHelper', 4);
DeleteService('BrsHelper');
SetServiceStart('AppMgr4.27.1676029', 4);
DeleteService('AppMgr4.27.1676029');
QuarantineFile('C:\Windows\system32\drivers\{944009a5-dde1-4778-861e-fb4fc61382dd}Gw64.sys','');
QuarantineFile('C:\Windows\system32\drivers\wsfd_vt_1_10_0_20.sys','');
QuarantineFile('C:\Windows\system32\drivers\wsafd_1_10_0_19.sys','');
QuarantineFile('C:\PROGRA~2\YTDownloader\sbmntr.sys','');
QuarantineFile('C:\Users\пользователь\AppData\Local\SmartWeb\swhk.dll','');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\ffmpegsumo.dll','');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome_elf.dll','');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome_child.dll','');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome.dll','');
QuarantineFile('C:\Program Files (x86)\Coupon Time\bin\944009a5dde14778861efb4fc61382dd.dll','');
QuarantineFile('C:\IQIYI Video\Common\UI.dll','');
QuarantineFile('C:\IQIYI Video\Common\QuiLib.dll','');
QuarantineFile('C:\IQIYI Video\Common\PopupWndProxy.dll','');
QuarantineFile('C:\IQIYI Video\Common\HCDNClientNet.dll','');
QuarantineFile('C:\IQIYI Video\Common\fp2xh.dll','');
QuarantineFile('C:\IQIYI Video\Common\AppNet.dll','');
QuarantineFile('C:\IQIYI Video\Common\Accelerator\VideoInfoExtract.dll','');
QuarantineFile('C:\IQIYI Video\Common\Accelerator\StrikeWing.dll','');
QuarantineFile('C:\IQIYI Video\Common\Accelerator\browserhook.dll','');
QuarantineFile('C:\IQIYI Video\Common\Accelerator\browseradapter.dll','');
TerminateProcessByName('c:\program files (x86)\wordshark_1.10.0.20\service\wssvc.exe');
QuarantineFile('c:\program files (x86)\wordshark_1.10.0.20\service\wssvc.exe','');
TerminateProcessByName('c:\program files (x86)\coupon time\bin\utilcoupontime.exe');
QuarantineFile('c:\program files (x86)\coupon time\bin\utilcoupontime.exe','');
TerminateProcessByName('c:\users\пользователь\appdata\local\gmsd_ru_005010032\upgmsd_ru_005010032.exe');
QuarantineFile('c:\users\пользователь\appdata\local\gmsd_ru_005010032\upgmsd_ru_005010032.exe','');
TerminateProcessByName('c:\program files (x86)\coupon time\updatecoupontime.exe');
QuarantineFile('c:\program files (x86)\coupon time\updatecoupontime.exe','');
TerminateProcessByName('c:\users\пользователь\appdata\local\547d33c0-1437073203-11e1-a3dc-30f9edbc1a27\snsbbbed.tmp');
QuarantineFile('c:\users\пользователь\appdata\local\547d33c0-1437073203-11e1-a3dc-30f9edbc1a27\snsbbbed.tmp','');
TerminateProcessByName('c:\users\пользователь\appdata\local\smartweb\smartwebhelper.exe');
QuarantineFile('c:\users\пользователь\appdata\local\smartweb\smartwebhelper.exe','');
TerminateProcessByName('c:\users\пользователь\appdata\local\smartweb\smartwebapp.exe');
QuarantineFile('c:\users\пользователь\appdata\local\smartweb\smartwebapp.exe','');
TerminateProcessByName('c:\iqiyi video\common\qykernel.exe');
QuarantineFile('c:\iqiyi video\common\qykernel.exe','');
TerminateProcessByName('c:\programdata\appmgr4.27.1676029\1\plugin.exe');
QuarantineFile('c:\programdata\appmgr4.27.1676029\1\plugin.exe','');
TerminateProcessByName('c:\program files (x86)\547d33c0-1437058733-11e1-a3dc-30f9edbc1a27\knswc72b.tmpfs');
QuarantineFile('c:\program files (x86)\547d33c0-1437058733-11e1-a3dc-30f9edbc1a27\knswc72b.tmpfs','');
TerminateProcessByName('c:\users\пользователь\appdata\roaming\547d33c0-1436870499-11e1-a3dc-30f9edbc1a27\jnsmde9f.tmp');
QuarantineFile('c:\users\пользователь\appdata\roaming\547d33c0-1436870499-11e1-a3dc-30f9edbc1a27\jnsmde9f.tmp','');
TerminateProcessByName('c:\program files (x86)\547d33c0-1437058733-11e1-a3dc-30f9edbc1a27\hnsw16b9.tmp');
QuarantineFile('c:\program files (x86)\547d33c0-1437058733-11e1-a3dc-30f9edbc1a27\hnsw16b9.tmp','');
TerminateProcessByName('c:\program files (x86)\gmsd_ru_005010032\gmsd_ru_005010032.exe');
QuarantineFile('c:\program files (x86)\gmsd_ru_005010032\gmsd_ru_005010032.exe','');
TerminateProcessByName('c:\program files (x86)\crossbrowse\crossbrowse\application\crossbrowse.exe');
QuarantineFile('c:\program files (x86)\crossbrowse\crossbrowse\application\crossbrowse.exe','');
TerminateProcessByName('C:\Windows\System32\cpuminer-gw64.exe');
QuarantineFile('C:\Windows\System32\cpuminer-gw64.exe','');
TerminateProcessByName('C:\Program Files (x86)\Coupon Time\bin\CouponTime.PurBrowse64.exe');
QuarantineFile('C:\Program Files (x86)\Coupon Time\bin\CouponTime.PurBrowse64.exe','');
TerminateProcessByName('c:\program files (x86)\coupon time\bin\coupontime.expext.exe');
QuarantineFile('c:\program files (x86)\coupon time\bin\coupontime.expext.exe','');
TerminateProcessByName('C:\Program Files (x86)\Coupon Time\bin\CouponTime.BrowserAdapter64.exe');
QuarantineFile('C:\Program Files (x86)\Coupon Time\bin\CouponTime.BrowserAdapter64.exe','');
TerminateProcessByName('c:\program files (x86)\coupon time\bin\coupontime.browseradapter.exe');
QuarantineFile('c:\program files (x86)\coupon time\bin\coupontime.browseradapter.exe','');
TerminateProcessByName('c:\progra~2\ytdownloader\browserhelpersrv.exe');
QuarantineFile('c:\progra~2\ytdownloader\browserhelpersrv.exe','');
TerminateProcessByName('c:\progra~2\ytdownloader\browserhelper.exe');
QuarantineFile('c:\progra~2\ytdownloader\browserhelper.exe','');
TerminateProcessByName('c:\program files (x86)\baidu\baidu.exe');
TerminateProcessByName('c:\program files (x86)\shop and save up\b3b23845-23db-4d7f-bb0a-d6a24433715e-6.exe');
QuarantineFile('c:\program files (x86)\shop and save up\b3b23845-23db-4d7f-bb0a-d6a24433715e-6.exe','');
TerminateProcessByName('c:\program files (x86)\shop and save up\b3b23845-23db-4d7f-bb0a-d6a24433715e-1-6.exe');
QuarantineFile('c:\program files (x86)\shop and save up\b3b23845-23db-4d7f-bb0a-d6a24433715e-1-6.exe','');
TerminateProcessByName('c:\programdata\appmgr4.27.1676029\appmgr.exe');
QuarantineFile('c:\programdata\appmgr4.27.1676029\appmgr.exe','');
TerminateProcessByName('c:\program files (x86)\object browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-6.exe');
QuarantineFile('c:\program files (x86)\object browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-6.exe','');
TerminateProcessByName('c:\program files (x86)\object browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-1-6.exe');
QuarantineFile('c:\program files (x86)\object browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-1-6.exe','');
TerminateProcessByName('c:\program files (x86)\ciplus-4.5vv16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-6.exe');
QuarantineFile('c:\program files (x86)\ciplus-4.5vv16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-6.exe','');
TerminateProcessByName('c:\program files (x86)\ciplus-4.5vv16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-1-6.exe');
QuarantineFile('c:\program files (x86)\ciplus-4.5vv16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-1-6.exe','');
TerminateProcessByName('c:\program files (x86)\iwebar\006d49aa-efdd-4047-9bd3-2df305130d81-6.exe');
QuarantineFile('c:\program files (x86)\iwebar\006d49aa-efdd-4047-9bd3-2df305130d81-6.exe','');
TerminateProcessByName('c:\program files (x86)\iwebar\006d49aa-efdd-4047-9bd3-2df305130d81-1-6.exe');
QuarantineFile('c:\program files (x86)\iwebar\006d49aa-efdd-4047-9bd3-2df305130d81-1-6.exe','');
DeleteFile('c:\program files (x86)\iwebar\006d49aa-efdd-4047-9bd3-2df305130d81-1-6.exe','32');
DeleteFile('c:\program files (x86)\iwebar\006d49aa-efdd-4047-9bd3-2df305130d81-6.exe','32');
DeleteFile('c:\program files (x86)\ciplus-4.5vv16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-1-6.exe','32');
DeleteFile('c:\program files (x86)\ciplus-4.5vv16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-6.exe','32');
DeleteFile('c:\program files (x86)\object browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-1-6.exe','32');
DeleteFile('c:\program files (x86)\object browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-6.exe','32');
DeleteFile('c:\programdata\appmgr4.27.1676029\appmgr.exe','32');
DeleteFile('c:\program files (x86)\shop and save up\b3b23845-23db-4d7f-bb0a-d6a24433715e-1-6.exe','32');
DeleteFile('c:\program files (x86)\shop and save up\b3b23845-23db-4d7f-bb0a-d6a24433715e-6.exe','32');
DeleteFile('c:\program files (x86)\baidu\baidu.exe','32');
DeleteFile('c:\progra~2\ytdownloader\browserhelper.exe','32');
DeleteFile('c:\progra~2\ytdownloader\browserhelpersrv.exe','32');
DeleteFile('c:\program files (x86)\coupon time\bin\coupontime.browseradapter.exe','32');
DeleteFile('C:\Program Files (x86)\Coupon Time\bin\CouponTime.BrowserAdapter64.exe','32');
DeleteFile('c:\program files (x86)\coupon time\bin\coupontime.expext.exe','32');
DeleteFile('C:\Program Files (x86)\Coupon Time\bin\CouponTime.PurBrowse64.exe','32');
DeleteFile('C:\Windows\System32\cpuminer-gw64.exe','32');
DeleteFile('c:\program files (x86)\crossbrowse\crossbrowse\application\crossbrowse.exe','32');
DeleteFile('c:\program files (x86)\gmsd_ru_005010032\gmsd_ru_005010032.exe','32');
DeleteFile('c:\program files (x86)\547d33c0-1437058733-11e1-a3dc-30f9edbc1a27\hnsw16b9.tmp','32');
DeleteFile('c:\users\пользователь\appdata\roaming\547d33c0-1436870499-11e1-a3dc-30f9edbc1a27\jnsmde9f.tmp','32');
DeleteFile('c:\program files (x86)\547d33c0-1437058733-11e1-a3dc-30f9edbc1a27\knswc72b.tmpfs','32');
DeleteFile('c:\programdata\appmgr4.27.1676029\1\plugin.exe','32');
DeleteFile('c:\iqiyi video\common\qykernel.exe','32');
DeleteFile('c:\users\пользователь\appdata\local\smartweb\smartwebapp.exe','32');
DeleteFile('c:\users\пользователь\appdata\local\smartweb\smartwebhelper.exe','32');
DeleteFile('c:\users\пользователь\appdata\local\547d33c0-1437073203-11e1-a3dc-30f9edbc1a27\snsbbbed.tmp','32');
DeleteFile('c:\program files (x86)\coupon time\updatecoupontime.exe','32');
DeleteFile('c:\users\пользователь\appdata\local\gmsd_ru_005010032\upgmsd_ru_005010032.exe','32');
DeleteFile('c:\program files (x86)\coupon time\bin\utilcoupontime.exe','32');
DeleteFile('c:\program files (x86)\wordshark_1.10.0.20\service\wssvc.exe','32');
DeleteFile('C:\IQIYI Video\Common\Accelerator\browseradapter.dll','32');
DeleteFile('C:\IQIYI Video\Common\Accelerator\browserhook.dll','32');
DeleteFile('C:\IQIYI Video\Common\Accelerator\StrikeWing.dll','32');
DeleteFile('C:\IQIYI Video\Common\Accelerator\VideoInfoExtract.dll','32');
DeleteFile('C:\IQIYI Video\Common\AppNet.dll','32');
DeleteFile('C:\IQIYI Video\Common\fp2xh.dll','32');
DeleteFile('C:\IQIYI Video\Common\HCDNClientNet.dll','32');
DeleteFile('C:\IQIYI Video\Common\PopupWndProxy.dll','32');
DeleteFile('C:\IQIYI Video\Common\QuiLib.dll','32');
DeleteFile('C:\IQIYI Video\Common\UI.dll','32');
DeleteFile('C:\Program Files (x86)\Coupon Time\bin\944009a5dde14778861efb4fc61382dd.dll','32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome.dll','32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome_child.dll','32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome_elf.dll','32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\ffmpegsumo.dll','32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\libegl.dll','32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\libglesv2.dll','32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\pdf.dll','32');
DeleteFile('C:\Users\пользователь\AppData\Local\SmartWeb\swhk.dll','32');
DeleteFile('C:\Windows\system32\DRIVERS\rsutils.sys','32');
DeleteFile('C:\PROGRA~2\YTDownloader\sbmntr.sys','32');
DeleteFile('C:\Windows\system32\DRIVERS\sysmon.sys','32');
DeleteFile('C:\Windows\system32\drivers\wsafd_1_10_0_19.sys','32');
DeleteFile('C:\Windows\system32\drivers\wsfd_vt_1_10_0_20.sys','32');
DeleteFile('C:\Windows\system32\drivers\{944009a5-dde1-4778-861e-fb4fc61382dd}Gw64.sys','32');
DeleteFile('C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe','32');
DeleteFile('C:\Program Files (x86)\Rising\RAV\ravmond.exe','32');
DeleteFile('C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe','32');
DeleteFile('C:\IQIYI Video\Common\QyKernel.exe','32');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','HCDNClient');
DeleteFile('C:\PROGRA~2\SupTab\SEARCH~1.DLL','32');
DeleteFile('C:\PROGRA~2\SupTab\SEARCH~2.DLL','32');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','GoogleChromeAutoLaunch_2C7112E7590F7855DA7611753754B6B1');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','YTDownloader');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','YTDownloader');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','apphide');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','gmsd_ru_005010032');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','SmartWeb');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\RunOnce','upgmsd_ru_005010032.exe');
DeleteFile('C:\Users\пользователь\AppData\Roaming\Browsers\exe.erolpxei.bat','32');
DeleteFile('C:\Users\пользователь\AppData\Roaming\cpuminer\sgminer\sgminer.cmd','32');
DeleteFile('C:\Program Files (x86)\Coupon Time\CouponTimebho.dll','32');
DeleteFile('C:\IQIYI Video\Common\Accelerator\IEHelper.dll','32');
DeleteFile('C:\Program Files (x86)\iWebar\006d49aa-efdd-4047-9bd3-2df305130d81-1-6.exe','32');
DeleteFile('C:\Program Files (x86)\iWebar\006d49aa-efdd-4047-9bd3-2df305130d81-1-7.exe','32');
DeleteFile('C:\Program Files (x86)\iWebar\006d49aa-efdd-4047-9bd3-2df305130d81-5.exe','32');
DeleteFile('C:\Program Files (x86)\iWebar\006d49aa-efdd-4047-9bd3-2df305130d81-6.exe','32');
DeleteFile('C:\Program Files (x86)\iWebar\006d49aa-efdd-4047-9bd3-2df305130d81-7.exe','32');
DeleteFile('C:\Windows\Tasks\006d49aa-efdd-4047-9bd3-2df305130d81-7.job','64');
DeleteFile('C:\Windows\Tasks\006d49aa-efdd-4047-9bd3-2df305130d81-6.job','64');
DeleteFile('C:\Windows\Tasks\006d49aa-efdd-4047-9bd3-2df305130d81-5_user.job','64');
DeleteFile('C:\Windows\Tasks\006d49aa-efdd-4047-9bd3-2df305130d81-5.job','64');
DeleteFile('C:\Windows\Tasks\006d49aa-efdd-4047-9bd3-2df305130d81-1-7.job','64');
DeleteFile('C:\Windows\Tasks\006d49aa-efdd-4047-9bd3-2df305130d81-1-6.job','64');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-1-6.exe','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-1-7.exe','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-10.exe','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-3.exe','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-5.exe','32');
DeleteFile('C:\Windows\Tasks\3e328f2f-4d8e-4467-84cd-1b272d34abac-5_user.job','64');
DeleteFile('C:\Windows\Tasks\3e328f2f-4d8e-4467-84cd-1b272d34abac-5.job','64');
DeleteFile('C:\Windows\Tasks\3e328f2f-4d8e-4467-84cd-1b272d34abac-3.job','64');
DeleteFile('C:\Windows\Tasks\3e328f2f-4d8e-4467-84cd-1b272d34abac-10_user.job','64');
DeleteFile('C:\Windows\Tasks\3e328f2f-4d8e-4467-84cd-1b272d34abac-1-7.job','64');
DeleteFile('C:\Windows\Tasks\3e328f2f-4d8e-4467-84cd-1b272d34abac-1-6.job','64');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-6.exe','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV16.07\3e328f2f-4d8e-4467-84cd-1b272d34abac-7.exe','32');
DeleteFile('C:\Windows\Tasks\3e328f2f-4d8e-4467-84cd-1b272d34abac-6.job','64');
DeleteFile('C:\Windows\Tasks\3e328f2f-4d8e-4467-84cd-1b272d34abac-7.job','64');
DeleteFile('C:\Windows\Tasks\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-7.job','64');
DeleteFile('C:\Windows\Tasks\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-6.job','64');
DeleteFile('C:\Windows\Tasks\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-5_user.job','64');
DeleteFile('C:\Windows\Tasks\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-5.job','64');
DeleteFile('C:\Windows\Tasks\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-1-7.job','64');
DeleteFile('C:\Windows\Tasks\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-1-6.job','64');
DeleteFile('C:\Program Files (x86)\Object Browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-7.exe','32');
DeleteFile('C:\Program Files (x86)\Object Browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-6.exe','32');
DeleteFile('C:\Program Files (x86)\Object Browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-5.exe','32');
DeleteFile('C:\Program Files (x86)\Object Browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-1-7.exe','32');
DeleteFile('C:\Program Files (x86)\Object Browser\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-1-6.exe','32');
DeleteFile('C:\Users\пользователь\AppData\Local\30337\Updater.exe','32');
DeleteFile('C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe','32');
DeleteFile('C:\Windows\Tasks\APSnotifierPP3.job','64');
DeleteFile('C:\Windows\Tasks\APSnotifierPP2.job','64');
DeleteFile('C:\Windows\Tasks\APSnotifierPP1.job','64');
DeleteFile('C:\Windows\Tasks\AmiUpdXp.job','64');
DeleteFile('C:\Windows\Tasks\b3b23845-23db-4d7f-bb0a-d6a24433715e-5_user.job','64');
DeleteFile('C:\Windows\Tasks\b3b23845-23db-4d7f-bb0a-d6a24433715e-5.job','64');
DeleteFile('C:\Windows\Tasks\b3b23845-23db-4d7f-bb0a-d6a24433715e-3.job','64');
DeleteFile('C:\Windows\Tasks\b3b23845-23db-4d7f-bb0a-d6a24433715e-10_user.job','64');
DeleteFile('C:\Windows\Tasks\b3b23845-23db-4d7f-bb0a-d6a24433715e-1-7.job','64');
DeleteFile('C:\Windows\Tasks\b3b23845-23db-4d7f-bb0a-d6a24433715e-1-6.job','64');
DeleteFile('C:\Program Files (x86)\Shop and Save Up\b3b23845-23db-4d7f-bb0a-d6a24433715e-5.exe','32');
DeleteFile('C:\Program Files (x86)\Shop and Save Up\b3b23845-23db-4d7f-bb0a-d6a24433715e-3.exe','32');
DeleteFile('C:\Program Files (x86)\Shop and Save Up\b3b23845-23db-4d7f-bb0a-d6a24433715e-10.exe','32');
DeleteFile('C:\Program Files (x86)\Shop and Save Up\b3b23845-23db-4d7f-bb0a-d6a24433715e-1-7.exe','32');
DeleteFile('C:\Program Files (x86)\Shop and Save Up\b3b23845-23db-4d7f-bb0a-d6a24433715e-1-6.exe','32');
DeleteFile('C:\Program Files (x86)\Shop and Save Up\b3b23845-23db-4d7f-bb0a-d6a24433715e-6.exe','32');
DeleteFile('C:\Program Files (x86)\Shop and Save Up\b3b23845-23db-4d7f-bb0a-d6a24433715e-7.exe','32');
DeleteFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-1-6.exe','32');
DeleteFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-1-7.exe','32');
DeleteFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-10.exe','32');
DeleteFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-11.exe','32');
DeleteFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-3.exe','32');
DeleteFile('C:\Windows\Tasks\b7672d65-0301-436a-804f-3ab3fc98c9af-3.job','64');
DeleteFile('C:\Windows\Tasks\b7672d65-0301-436a-804f-3ab3fc98c9af-11.job','64');
DeleteFile('C:\Windows\Tasks\b7672d65-0301-436a-804f-3ab3fc98c9af-10_user.job','64');
DeleteFile('C:\Windows\Tasks\b7672d65-0301-436a-804f-3ab3fc98c9af-1-7.job','64');
DeleteFile('C:\Windows\Tasks\b7672d65-0301-436a-804f-3ab3fc98c9af-1-6.job','64');
DeleteFile('C:\Windows\Tasks\b3b23845-23db-4d7f-bb0a-d6a24433715e-7.job','64');
DeleteFile('C:\Windows\Tasks\b3b23845-23db-4d7f-bb0a-d6a24433715e-6.job','64');
DeleteFile('C:\Windows\Tasks\b7672d65-0301-436a-804f-3ab3fc98c9af-5.job','64');
DeleteFile('C:\Windows\Tasks\b7672d65-0301-436a-804f-3ab3fc98c9af-5_user.job','64');
DeleteFile('C:\Windows\Tasks\b7672d65-0301-436a-804f-3ab3fc98c9af-6.job','64');
DeleteFile('C:\Windows\Tasks\b7672d65-0301-436a-804f-3ab3fc98c9af-7.job','64');
DeleteFile('C:\Windows\Tasks\Crossbrowse.job','64');
DeleteFile('C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job','64');
DeleteFile('C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job','64');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe','32');
DeleteFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-7.exe','32');
DeleteFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-6.exe','32');
DeleteFile('C:\Program Files (x86)\PlusHD_5.1V08.07\b7672d65-0301-436a-804f-3ab3fc98c9af-5.exe','32');
DeleteFile('C:\Windows\Tasks\xbs7jNHFpQjKC.job','64');
DeleteFile('C:\Windows\system32\Tasks\006d49aa-efdd-4047-9bd3-2df305130d81-1-6','64');
DeleteFile('C:\Windows\system32\Tasks\006d49aa-efdd-4047-9bd3-2df305130d81-1-7','64');
DeleteFile('C:\Windows\system32\Tasks\006d49aa-efdd-4047-9bd3-2df305130d81-5','64');
DeleteFile('C:\Windows\system32\Tasks\006d49aa-efdd-4047-9bd3-2df305130d81-6','64');
DeleteFile('C:\Windows\system32\Tasks\006d49aa-efdd-4047-9bd3-2df305130d81-7','64');
DeleteFile('C:\Windows\system32\Tasks\3e328f2f-4d8e-4467-84cd-1b272d34abac-1-6','64');
DeleteFile('C:\Windows\system32\Tasks\3e328f2f-4d8e-4467-84cd-1b272d34abac-1-7','64');
DeleteFile('C:\Windows\system32\Tasks\3e328f2f-4d8e-4467-84cd-1b272d34abac-3','64');
DeleteFile('C:\Windows\system32\Tasks\3e328f2f-4d8e-4467-84cd-1b272d34abac-5','64');
DeleteFile('C:\Windows\system32\Tasks\3e328f2f-4d8e-4467-84cd-1b272d34abac-6','64');
DeleteFile('C:\Windows\system32\Tasks\3e328f2f-4d8e-4467-84cd-1b272d34abac-7','64');
DeleteFile('C:\Windows\system32\Tasks\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-1-6','64');
DeleteFile('C:\Windows\system32\Tasks\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-1-7','64');
DeleteFile('C:\Windows\system32\Tasks\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-5','64');
DeleteFile('C:\Windows\system32\Tasks\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-6','64');
DeleteFile('C:\Windows\system32\Tasks\474f6156-2dee-4bca-9ad1-ea0db6a47b7f-7','64');
DeleteFile('C:\Windows\system32\Tasks\AmiUpdXp','64');
DeleteFile('C:\Windows\system32\Tasks\APSnotifierPP1','64');
DeleteFile('C:\Windows\system32\Tasks\APSnotifierPP2','64');
DeleteFile('C:\Windows\system32\Tasks\APSnotifierPP3','64');
DeleteFile('C:\Windows\system32\Tasks\b3b23845-23db-4d7f-bb0a-d6a24433715e-1-6','64');
DeleteFile('C:\Windows\system32\Tasks\b3b23845-23db-4d7f-bb0a-d6a24433715e-1-7','64');
DeleteFile('C:\Windows\system32\Tasks\b3b23845-23db-4d7f-bb0a-d6a24433715e-3','64');
DeleteFile('C:\Windows\system32\Tasks\b3b23845-23db-4d7f-bb0a-d6a24433715e-5','64');
DeleteFile('C:\Windows\system32\Tasks\b3b23845-23db-4d7f-bb0a-d6a24433715e-6','64');
DeleteFile('C:\Windows\system32\Tasks\b3b23845-23db-4d7f-bb0a-d6a24433715e-7','64');
DeleteFile('C:\Windows\system32\Tasks\b7672d65-0301-436a-804f-3ab3fc98c9af-11','64');
DeleteFile('C:\Windows\system32\Tasks\b7672d65-0301-436a-804f-3ab3fc98c9af-1-7','64');
DeleteFile('C:\Windows\system32\Tasks\b7672d65-0301-436a-804f-3ab3fc98c9af-3','64');
DeleteFile('C:\Windows\system32\Tasks\b7672d65-0301-436a-804f-3ab3fc98c9af-5','64');
DeleteFile('C:\Windows\system32\Tasks\b7672d65-0301-436a-804f-3ab3fc98c9af-7','64');
DeleteFile('C:\Windows\system32\Tasks\chrome5','64');
DeleteFile('C:\Windows\system32\Tasks\chrome5_logon','64');
DeleteFile('C:\Windows\system32\Tasks\Crossbrowse','64');
DeleteFile('C:\Windows\system32\Tasks\globalUpdateUpdateTaskMachineCore','64');
DeleteFile('C:\Windows\system32\Tasks\globalUpdateUpdateTaskMachineUA','64');
DeleteFile('C:\Program Files (x86)\Microsoft Data\install_addons.exe','32');
DeleteFile('C:\Windows\system32\Tasks\SmartWeb Upgrade Trigger Task','64');
DeleteFile('C:\Windows\system32\Tasks\Soft installer','64');
DeleteFile('C:\Windows\system32\Tasks\WordShark Auto Updater 1.10.0.20 Core','64');
DeleteFile('C:\Windows\system32\Tasks\WordShark Auto Updater 1.10.0.20 Pending Update','64');
DeleteFile('C:\Windows\system32\Tasks\WordSurfer Auto Updater 1.10.0.19 Core','64');
DeleteFile('C:\Windows\system32\Tasks\WordSurfer Auto Updater 1.10.0.19 Pending Update','64');
DeleteFile('C:\Windows\system32\Tasks\YTDownloader','64');
DeleteFile('C:\Windows\system32\Tasks\YTDownloaderUpd','64');
DeleteFile('C:\Users\пользователь\AppData\Roaming\WindowsUpdater\Updater.exe','32');
DeleteFile('C:\Program Files (x86)\WordShark_1.10.0.20\Update\WordSharkAutoUpdateClient.exe','32');
DeleteFile('C:\Program Files (x86)\WordSurfer_1.10.0.19\Update\WordSurferAutoUpdateClient.exe','32');
DeleteFile('C:\Program Files (x86)\YTDownloader\YTDownloader.exe','32');
DeleteFile('C:\Program Files (x86)\YTDownloader\updater.exe','32');
DeleteFile('C:\Windows\system32\Tasks\WindowsUpdater','64');
DeleteFile('C:\Users\пользователь\appdata\local\smartweb\__u.exe','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.[/code]Будет выполнена перезагрузка компьютера.

Пришлите карантин согласно [B]Приложения 2[/B] правил по красной ссылке [COLOR="Red"][U][B]Прислать запрошенный карантин[/B][/U][/COLOR] над первым сообщением темы.

[B][COLOR="Red"]Выполните ЕЩЕ РАЗ правила и предоставьте НОВЫЕ логи[/COLOR][/B]

Карантин загрузил, вот новые логи. С Google Chrome вроде проблема решилась, по крайней мере с поисковиком все ок. После перезагрузки пока сторонних программ не наблюдаю.

Сделайте лог [url="http://virusinfo.info/showthread.php?t=53070&p=1104657&viewfull=1#post1104657"]полного сканирования МВАМ[/url]

Как по инструкции.

Удалите в МВАМ все найденное

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]1[/B][*]Обработано файлов: [B]11[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\users\пользователь\appdata\roaming\aspackage\aspackage.exe - [B]Trojan-Downloader.Win32.Genome.tlkc[/B] ( AVAST4: Win32:Dropper-gen [Drp] )[*] c:\users\пользователь\appdata\roaming\547d33c0-1436870499-11e1-a3dc-30f9edbc1a27\jnsmde9f.tmp - [B]not-a-virus:AdWare.Win32.ConvertAd.awz[/B] ( AVAST4: Win32:Rootkit-gen [Rtk] )[/LIST][/LIST]