Не удалить CiPlus, + постоянно подгружаются новые программы [not-a-virus:AdWare.Win32.ConvertAd.bai, not-a-virus:WebToolbar.Win32.CroRi.fte ]

Printable View

24.10.2015, 16:18
Антон Лебедев

Вложений: 2

Не удалить CiPlus, + постоянно подгружаются новые программы [not-a-virus:AdWare.Win32.ConvertAd.bai, not-a-virus:WebToolbar.Win32.CroRi.fte ]

Добрый день!
Случайно были пойманы вирусы Crossbrowser и CiPlus 4.5 и еще много сторонних программ. Все вроде бы удалил кроме CiPlus. Но все-равно что то подгружается еще. Сегодня GamesDesktop. Если убрать антивирусник, то crossbrowser и еще много программ появляется заново. Постоянно выпрыгивает реклама в браузерах. Помогите, пожалуйста
24.10.2015, 16:22
Info_bot

Уважаемый(ая) [B]Антон Лебедев[/B], спасибо за обращение на наш форум!

Помощь в лечении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в [URL="http://virusinfo.info/pravila.html"]правилах оформления запроса о помощи[/URL].

[INFORMATION]Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом [URL="http://virusinfo.info/content.php?r=613-sub_pomogite"]Помогите+[/URL].[/INFORMATION]

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста [URL="http://virusinfo.info/content.php?r=113-virusinfo.info-donate"]поддержите проект[/URL].
24.10.2015, 23:45
Vvvyg

Браузером Amigo пользуетесь?

[url="http://virusinfo.info/showthread.php?t=7239"]Выполните скрипт в AVZ[/url]:[code]begin
TerminateProcessByName('c:\program files (x86)\sfk\ssfk.exe');
TerminateProcessByName('c:\users\user\appdata\local\46364331-1445075399-4432-4532-3444ffffffff\qnsw9c02.tmp');
TerminateProcessByName('c:\program files (x86)\46364331-1444827562-4432-4532-3444ffffffff\knsr6c52.tmp');
TerminateProcessByName('c:\program files (x86)\46364331-1444827562-4432-4532-3444ffffffff\jnsp41e7.tmp');
TerminateProcessByName('c:\program files (x86)\46364331-1444827562-4432-4532-3444ffffffff\hnse574c.tmp');
QuarantineFile('C:\Users\USER\AppData\Roaming\zFFDy0AKT62Q05QnT.exe', '');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-7.exe', '');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-5.exe', '');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-3.exe', '');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-11.exe', '');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-1-7.exe', '');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-1-6.exe', '');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV22.10\54e14810-ade6-4c05-8617-cbc4dea65de7-7.exe', '');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV22.10\54e14810-ade6-4c05-8617-cbc4dea65de7-5.exe', '');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV22.10\54e14810-ade6-4c05-8617-cbc4dea65de7-3.exe', '');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV22.10\54e14810-ade6-4c05-8617-cbc4dea65de7-11.exe', '');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV22.10\54e14810-ade6-4c05-8617-cbc4dea65de7-1-7.exe', '');
QuarantineFile('C:\Program Files (x86)\gmsd_ru_005010123\gmsd_ru_005010123.exe', '');
QuarantineFile('c:\program files (x86)\sfk\ssfk.exe', '');
QuarantineFile('c:\users\user\appdata\local\46364331-1445075399-4432-4532-3444ffffffff\qnsw9c02.tmp', '');
QuarantineFile('c:\program files (x86)\46364331-1444827562-4432-4532-3444ffffffff\knsr6c52.tmp', '');
QuarantineFile('c:\program files (x86)\46364331-1444827562-4432-4532-3444ffffffff\jnsp41e7.tmp', '');
QuarantineFile('c:\program files (x86)\46364331-1444827562-4432-4532-3444ffffffff\hnse574c.tmp', '');
DeleteFile('c:\program files (x86)\46364331-1444827562-4432-4532-3444ffffffff\hnse574c.tmp', '32');
DeleteFile('c:\program files (x86)\46364331-1444827562-4432-4532-3444ffffffff\jnsp41e7.tmp', '32');
DeleteFile('c:\program files (x86)\46364331-1444827562-4432-4532-3444ffffffff\knsr6c52.tmp', '32');
DeleteFile('c:\users\user\appdata\local\46364331-1445075399-4432-4532-3444ffffffff\qnsw9c02.tmp', '32');
DeleteFile('c:\program files (x86)\sfk\ssfk.exe', '32');
DeleteFile('C:\Program Files (x86)\gmsd_ru_005010123\gmsd_ru_005010123.exe', '32');
DeleteFile('C:\Windows\Tasks\54e14810-ade6-4c05-8617-cbc4dea65de7-1-6.job', '32');
DeleteFile('C:\Windows\Tasks\54e14810-ade6-4c05-8617-cbc4dea65de7-1-7.job', '32');
DeleteFile('C:\Windows\Tasks\54e14810-ade6-4c05-8617-cbc4dea65de7-10_user.job', '32');
DeleteFile('C:\Windows\Tasks\54e14810-ade6-4c05-8617-cbc4dea65de7-11.job', '32');
DeleteFile('C:\Windows\Tasks\54e14810-ade6-4c05-8617-cbc4dea65de7-3.job', '32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV22.10\54e14810-ade6-4c05-8617-cbc4dea65de7-1-7.exe', '32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV22.10\54e14810-ade6-4c05-8617-cbc4dea65de7-11.exe', '32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV22.10\54e14810-ade6-4c05-8617-cbc4dea65de7-3.exe', '32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV22.10\54e14810-ade6-4c05-8617-cbc4dea65de7-5.exe', '32');
DeleteFile('C:\Windows\Tasks\54e14810-ade6-4c05-8617-cbc4dea65de7-5.job', '32');
DeleteFile('C:\Windows\Tasks\54e14810-ade6-4c05-8617-cbc4dea65de7-5_user.job', '32');
DeleteFile('C:\Windows\Tasks\54e14810-ade6-4c05-8617-cbc4dea65de7-6.job', '32');
DeleteFile('C:\Windows\Tasks\54e14810-ade6-4c05-8617-cbc4dea65de7-7.job', '32');
DeleteFile('C:\Windows\Tasks\aedca078-77f9-4ef1-a564-d8b197ab2139-1-6.job', '32');
DeleteFile('C:\Windows\Tasks\aedca078-77f9-4ef1-a564-d8b197ab2139-1-7.job', '32');
DeleteFile('C:\Windows\Tasks\aedca078-77f9-4ef1-a564-d8b197ab2139-10_user.job', '32');
DeleteFile('C:\Windows\Tasks\aedca078-77f9-4ef1-a564-d8b197ab2139-11.job', '32');
DeleteFile('C:\Windows\Tasks\aedca078-77f9-4ef1-a564-d8b197ab2139-3.job', '32');
DeleteFile('C:\Windows\Tasks\aedca078-77f9-4ef1-a564-d8b197ab2139-5.job', '32');
DeleteFile('C:\Windows\Tasks\aedca078-77f9-4ef1-a564-d8b197ab2139-5_user.job', '32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV22.10\54e14810-ade6-4c05-8617-cbc4dea65de7-7.exe', '32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-1-6.exe', '32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-1-7.exe', '32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-11.exe', '32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-3.exe', '32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-5.exe', '32');
DeleteFile('C:\Windows\Tasks\aedca078-77f9-4ef1-a564-d8b197ab2139-6.job', '32');
DeleteFile('C:\Windows\Tasks\aedca078-77f9-4ef1-a564-d8b197ab2139-7.job', '32');
DeleteFile('C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job', '32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-7.exe', '32');
DeleteFile('C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job', '32');
DeleteFile('C:\Users\USER\AppData\Roaming\zFFDy0AKT62Q05QnT.exe', '32');
DeleteFile('C:\Windows\Tasks\zFFDy0AKT62Q05QnT.job', '32');
DeleteService('wwfd_vt_1_10_0_24');
DeleteService('wfdrvr_vt_1_10_0_25');
DeleteService('WdsManPro');
DeleteFileMask('C:\Program Files (x86)\CiPlus-4.5vV16.10', '*', true);
DeleteFileMask('c:\program files (x86)\sfk', '*', true);
DeleteFileMask('C:\Program Files (x86)\gmsd_ru_005010123', '*', true);
DeleteFileMask('c:\users\user\appdata\local\46364331-1445075399-4432-4532-3444ffffffff', '*', true);
DeleteFileMask('c:\program files (x86)\46364331-1444827562-4432-4532-3444ffffffff', '*', true);
DeleteDirectory('C:\Program Files (x86)\CiPlus-4.5vV16.10');
DeleteDirectory('c:\program files (x86)\sfk');
DeleteDirectory('C:\Program Files (x86)\gmsd_ru_005010123');
DeleteDirectory('c:\users\user\appdata\local\46364331-1445075399-4432-4532-3444ffffffff');
DeleteDirectory('c:\program files (x86)\46364331-1444827562-4432-4532-3444ffffffff');
ExecuteFile('schtasks.exe', '/delete /TN "54e14810-ade6-4c05-8617-cbc4dea65de7-1-6" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "54e14810-ade6-4c05-8617-cbc4dea65de7-1-7" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "54e14810-ade6-4c05-8617-cbc4dea65de7-10_user" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "54e14810-ade6-4c05-8617-cbc4dea65de7-11" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "54e14810-ade6-4c05-8617-cbc4dea65de7-3" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "54e14810-ade6-4c05-8617-cbc4dea65de7-5" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "54e14810-ade6-4c05-8617-cbc4dea65de7-5_user" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "54e14810-ade6-4c05-8617-cbc4dea65de7-6" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "54e14810-ade6-4c05-8617-cbc4dea65de7-7" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "aedca078-77f9-4ef1-a564-d8b197ab2139-1-6" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "aedca078-77f9-4ef1-a564-d8b197ab2139-1-7" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "aedca078-77f9-4ef1-a564-d8b197ab2139-11" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "aedca078-77f9-4ef1-a564-d8b197ab2139-3" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "aedca078-77f9-4ef1-a564-d8b197ab2139-5" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "aedca078-77f9-4ef1-a564-d8b197ab2139-5_user" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "aedca078-77f9-4ef1-a564-d8b197ab2139-6" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "aedca078-77f9-4ef1-a564-d8b197ab2139-7" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "globalUpdateUpdateTaskMachineCore" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "globalUpdateUpdateTaskMachineUA" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "MailRuUpdateTask" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "SmartWeb Upgrade Trigger Task" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "zFFDy0AKT62Q05QnT" /F', 0, 15000, true);
ExecuteSysClean;
ExecuteWizard('SCU', 2, 2, true);
ExecuteWizard('TSW', 2, 2, true);
RebootWindows(true);
end.[/code]Компьютер перезагрузится.
Выполните в AVZ скрипт:
[CODE]begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.[/CODE]
В папке с AVZ появится архив карантина quarantine.zip, отправьте этот файл по ссылке "Прислать запрошенный карантин" над над первым сообщением в теме.

Выполните 2-й стандартный скрипт в AVZ и прикрепите к своему следующему сообщению файл virusinfo_syscheck.zip.

Сделайте лог [URL="http://virusinfo.info/showthread.php?t=146192&p=1041844&viewfull=1#post1041844"]AdwCleaner (by Xplode)[/URL].

Сделайте лог [URL="http://virusinfo.info/soft/tool.php?tool=checkbrowserlnk"]Check Browsers' LNK[/URL].
25.10.2015, 14:29
Антон Лебедев

Вложений: 3

Я пользуюсь оперой, а жена амиго и ещё гугл хром вроде бы.

[COLOR="silver"]- - - - -Добавлено - - - - -[/COLOR]

Лог адв

[COLOR="silver"]- - - - -Добавлено - - - - -[/COLOR]

Лог check
25.10.2015, 15:41
Vvvyg

Скачайте, распакуйте и запустите [url=http://virusinfo.info/soft/tool.php?tool=ClearLNK]утилиту ClearLNK[/url]. Скопируйте текст ниже в окно утилиты и нажмите "[B]Лечить[/B]".[CODE]>>> [script][MASK] "C:\Users\USER\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Gоogle Сhrоme.lnk" -> ["C:\ProgramData\lENdmS\vEoRCArLWtRivR0.bat" =>> hxxp://vvv.mystartsearch.com/?type=sc&ts=1445064587&z=e5e957db6bd6fac5fd94758gaz2z8w4e8q9zcw5wdz&from=cmi&uid=ST1000DM003-9YN162_Z1D07XC9XXXXZ1D07XC9] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (532 байт.) (MD5:416F689482B513D66D2E08D1A8383F5F)
>>> [script][h] "C:\Users\USER\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk" -> ["C:\ProgramData\ye\BywawwN5.bat"] -> chcp 1251 >NUL¶ set /p command1=< "%~dp050"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command2=< "%~dp051"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp052"¶ ping 192.0.0.1 -n 1 -w 1 > nul¶ set /p command4=< "%~dp053"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp054"¶ ping 192.0 (461 байт.) (MD5:9D20CDA53155919652B14689441B9745)
>>> [script][MASK] "C:\Users\USER\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunch Intеrnet Eхрlоrer Brоwser.lnk" -> ["C:\ProgramData\ye\BywawwN5.bat"] -> chcp 1251 >NUL¶ set /p command1=< "%~dp050"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command2=< "%~dp051"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp052"¶ ping 192.0.0.1 -n 1 -w 1 > nul¶ set /p command4=< "%~dp053"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp054"¶ ping 192.0 (461 байт.) (MD5:9D20CDA53155919652B14689441B9745)
>>> [script][MASK] "C:\Users\USER\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Intеrnet Eхрlоrеr (2).lnk" -> ["C:\ProgramData\ye\BywawwN5.bat"] -> chcp 1251 >NUL¶ set /p command1=< "%~dp050"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command2=< "%~dp051"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp052"¶ ping 192.0.0.1 -n 1 -w 1 > nul¶ set /p command4=< "%~dp053"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp054"¶ ping 192.0 (461 байт.) (MD5:9D20CDA53155919652B14689441B9745)
>>> [script][MASK] "C:\Users\USER\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Intеrnet Eхрlоrеr.lnk" -> ["C:\ProgramData\ye\BywawwN5.bat"] -> chcp 1251 >NUL¶ set /p command1=< "%~dp050"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command2=< "%~dp051"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp052"¶ ping 192.0.0.1 -n 1 -w 1 > nul¶ set /p command4=< "%~dp053"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp054"¶ ping 192.0 (461 байт.) (MD5:9D20CDA53155919652B14689441B9745)
>>> [script] "C:\Users\USER\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera.lnk" -> ["C:\ProgramData\AdQiMc\AyFRkfYCh2.bat" =>> hxxp://vvv.mystartsearch.com/?type=sc&ts=1445064587&z=e5e957db6bd6fac5fd94758gaz2z8w4e8q9zcw5wdz&from=cmi&uid=ST1000DM003-9YN162_Z1D07XC9XXXXZ1D07XC9] -> chcp 1251 >NUL¶ set /p command1=< "%~dp020"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command2=< "%~dp021"¶ ping 192.0.0.1 -n 1 -w 4 > nul¶ set /p command3=< "%~dp022"¶ ping 192.0.0.1 -n 1 -w 1 > nul¶ set /p command4=< "%~dp023"¶ ping 192.0.0.1 -n 1 -w 4 > nul¶ set /p command5=< "%~dp024"¶ ping 192.0 (532 байт.) (MD5:06C3594157C000445427EF4438D4F768)
>>> [script][MASK] "C:\Users\USER\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Вoйти в Интернет (2).lnk" -> ["C:\ProgramData\lENdmS\vEoRCArLWtRivR0.bat" =>> hxxp://vvv.mystartsearch.com/?type=sc&ts=1445064587&z=e5e957db6bd6fac5fd94758gaz2z8w4e8q9zcw5wdz&from=cmi&uid=ST1000DM003-9YN162_Z1D07XC9XXXXZ1D07XC9] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (532 байт.) (MD5:416F689482B513D66D2E08D1A8383F5F)
>>> [script][MASK] "C:\Users\USER\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Вoйти в Интернет.lnk" -> ["C:\ProgramData\lENdmS\vEoRCArLWtRivR0.bat" =>> hxxp://vvv.mystartsearch.com/?type=sc&ts=1445064587&z=e5e957db6bd6fac5fd94758gaz2z8w4e8q9zcw5wdz&from=cmi&uid=ST1000DM003-9YN162_Z1D07XC9XXXXZ1D07XC9] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (532 байт.) (MD5:416F689482B513D66D2E08D1A8383F5F)
>>> [script][MASK][s] "C:\Users\USER\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Ореra12.15 1748.lnk" -> ["C:\Users\USER\AppData\Roaming\Browsers\exe.arepo.bat"] -> start "" "c:\PROGRA~2\opera\opera.exe" "hxxp://pagego.ru/?from=cru1" ( обфусцирован ) (476 байт.) (MD5:00422C7A91090B568898C853CCC7DC25)
>>> [script][h] "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Google Chrome.lnk" -> ["C:\ProgramData\lENdmS\vEoRCArLWtRivR0.bat"] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (532 байт.) (MD5:416F689482B513D66D2E08D1A8383F5F)
>>> [script][MASK] "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Gоogle Chrоmе.lnk" -> ["C:\ProgramData\lENdmS\vEoRCArLWtRivR0.bat"] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (532 байт.) (MD5:416F689482B513D66D2E08D1A8383F5F)
>>> [script][h] "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Yandex.lnk" -> ["C:\ProgramData\IyOiowMWitKs\lGscOzZjXspqH1.bat" =>> "hxxp://mir-all.ru" "hxxp://startmy.ru"] -> chcp 1251 >NUL¶ set /p command1=< "%~dp010"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command2=< "%~dp011"¶ ping 192.0.0.1 -n 1 -w 4 > nul¶ set /p command3=< "%~dp012"¶ ping 192.0.0.1 -n 1 -w 1 > nul¶ set /p command4=< "%~dp013"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp014"¶ ping 192.0 (390 байт.) (MD5:8CCDF24018749F86CC1E615494D1C4BD)
>>> [script][MASK][s] "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Yаndex.lnk" -> ["C:\Users\USER\AppData\Roaming\Browsers\exe.resworb.bat"] -> start "" "c:\users\user\appdata\local\yandex\yandexbrowser\application\browser.exe" "hxxp://pagego.ru/?from=cru1" ( обфусцирован ) (791 байт.) (MD5:46A17D2D04FF54C613267A474F3E5C25)
>>> [script][MASK] "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Вoйти в Интернет.lnk" -> ["C:\ProgramData\lENdmS\vEoRCArLWtRivR0.bat"] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (532 байт.) (MD5:416F689482B513D66D2E08D1A8383F5F)
>>> [script][h] "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Войти в Интернет.lnk" -> ["C:\ProgramData\lENdmS\vEoRCArLWtRivR0.bat"] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (532 байт.) (MD5:416F689482B513D66D2E08D1A8383F5F)
>>> [script][MASK] "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Еxрlоrer.lnk" -> ["C:\ProgramData\ye\BywawwN5.bat"] -> chcp 1251 >NUL¶ set /p command1=< "%~dp050"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command2=< "%~dp051"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp052"¶ ping 192.0.0.1 -n 1 -w 1 > nul¶ set /p command4=< "%~dp053"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp054"¶ ping 192.0 (461 байт.) (MD5:9D20CDA53155919652B14689441B9745)
>>> [script][MASK] "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Intеrnet Exрlоrеr (No Аdd-оns).lnk" -> ["C:\ProgramData\ye\BywawwN5.bat"] -> chcp 1251 >NUL¶ set /p command1=< "%~dp050"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command2=< "%~dp051"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp052"¶ ping 192.0.0.1 -n 1 -w 1 > nul¶ set /p command4=< "%~dp053"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp054"¶ ping 192.0 (461 байт.) (MD5:9D20CDA53155919652B14689441B9745)
>>> [script][MASK] "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Интернет\Вoйти в Интернет.lnk" -> ["C:\ProgramData\lENdmS\vEoRCArLWtRivR0.bat" =>> hxxp://vvv.mystartsearch.com/?type=sc&ts=1445064587&z=e5e957db6bd6fac5fd94758gaz2z8w4e8q9zcw5wdz&from=cmi&uid=ST1000DM003-9YN162_Z1D07XC9XXXXZ1D07XC9] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (532 байт.) (MD5:416F689482B513D66D2E08D1A8383F5F)
>>> [script] "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Интернет\Войти в Интернет.lnk" -> ["C:\Users\USER\AppData\Local\lsTVCi\LkkXXC0.bat" =>> hxxp://vvv.mystartsearch.com/?type=sc&ts=1445064587&z=e5e957db6bd6fac5fd94758gaz2z8w4e8q9zcw5wdz&from=cmi&uid=ST1000DM003-9YN162_Z1D07XC9XXXXZ1D07XC9] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 1 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (390 байт.) (MD5:17A5C1BCDCC02C1501AE9D8CD77E431C)
>>> [script] "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Интернет\Интернет.lnk" -> ["C:\ProgramData\lENdmS\vEoRCArLWtRivR0.bat" =>> hxxp://vvv.mystartsearch.com/?type=sc&ts=1445064587&z=e5e957db6bd6fac5fd94758gaz2z8w4e8q9zcw5wdz&from=cmi&uid=ST1000DM003-9YN162_Z1D07XC9XXXXZ1D07XC9] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (532 байт.) (MD5:416F689482B513D66D2E08D1A8383F5F)
>>> [script][MASK] "C:\Users\USER\Desktop\Вoйти в Интернет.lnk" -> ["C:\ProgramData\lENdmS\vEoRCArLWtRivR0.bat" =>> hxxp://vvv.mystartsearch.com/?type=sc&ts=1445064587&z=e5e957db6bd6fac5fd94758gaz2z8w4e8q9zcw5wdz&from=cmi&uid=ST1000DM003-9YN162_Z1D07XC9XXXXZ1D07XC9] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (532 байт.) (MD5:416F689482B513D66D2E08D1A8383F5F)
>>> [script][MASK] "C:\Users\USER\Desktop\Искaть в Интернете.lnk" -> ["C:\ProgramData\lENdmS\vEoRCArLWtRivR0.bat" =>> hxxp://vvv.mystartsearch.com/?type=sc&ts=1445064587&z=e5e957db6bd6fac5fd94758gaz2z8w4e8q9zcw5wdz&from=cmi&uid=ST1000DM003-9YN162_Z1D07XC9XXXXZ1D07XC9] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (532 байт.) (MD5:416F689482B513D66D2E08D1A8383F5F)
>>> [script][MASK] "C:\Users\Public\Desktop\Gооgle Сhrоmе.lnk" -> ["C:\ProgramData\lENdmS\vEoRCArLWtRivR0.bat" =>> hxxp://vvv.mystartsearch.com/?type=sc&ts=1445064587&z=e5e957db6bd6fac5fd94758gaz2z8w4e8q9zcw5wdz&from=cmi&uid=ST1000DM003-9YN162_Z1D07XC9XXXXZ1D07XC9] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (532 байт.) (MD5:416F689482B513D66D2E08D1A8383F5F)
>>> [script] "C:\Users\Public\Desktop\Opera.lnk" -> ["C:\ProgramData\AdQiMc\AyFRkfYCh2.bat" =>> hxxp://vvv.mystartsearch.com/?type=sc&ts=1445064587&z=e5e957db6bd6fac5fd94758gaz2z8w4e8q9zcw5wdz&from=cmi&uid=ST1000DM003-9YN162_Z1D07XC9XXXXZ1D07XC9] -> chcp 1251 >NUL¶ set /p command1=< "%~dp020"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command2=< "%~dp021"¶ ping 192.0.0.1 -n 1 -w 4 > nul¶ set /p command3=< "%~dp022"¶ ping 192.0.0.1 -n 1 -w 1 > nul¶ set /p command4=< "%~dp023"¶ ping 192.0.0.1 -n 1 -w 4 > nul¶ set /p command5=< "%~dp024"¶ ping 192.0 (532 байт.) (MD5:06C3594157C000445427EF4438D4F768)
>>> [script][h] "C:\ProgramData\Microsoft\Windows\Start Menu\Google Chrome.lnk" -> ["C:\ProgramData\lENdmS\vEoRCArLWtRivR0.bat"] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (532 байт.) (MD5:416F689482B513D66D2E08D1A8383F5F)
>>> [script][MASK] "C:\ProgramData\Microsoft\Windows\Start Menu\Gооgle Chrоme.lnk" -> ["C:\ProgramData\lENdmS\vEoRCArLWtRivR0.bat"] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (532 байт.) (MD5:416F689482B513D66D2E08D1A8383F5F)
>>> [script] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk" -> ["C:\ProgramData\AdQiMc\AyFRkfYCh2.bat" =>> hxxp://vvv.mystartsearch.com/?type=sc&ts=1445064587&z=e5e957db6bd6fac5fd94758gaz2z8w4e8q9zcw5wdz&from=cmi&uid=ST1000DM003-9YN162_Z1D07XC9XXXXZ1D07XC9] -> chcp 1251 >NUL¶ set /p command1=< "%~dp020"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command2=< "%~dp021"¶ ping 192.0.0.1 -n 1 -w 4 > nul¶ set /p command3=< "%~dp022"¶ ping 192.0.0.1 -n 1 -w 1 > nul¶ set /p command4=< "%~dp023"¶ ping 192.0.0.1 -n 1 -w 4 > nul¶ set /p command5=< "%~dp024"¶ ping 192.0 (532 байт.) (MD5:06C3594157C000445427EF4438D4F768)
>>> [script][MASK][s] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Оpera.lnk" -> ["C:\Users\USER\AppData\Roaming\Browsers\exe.arepo.bat"] -> start "" "c:\PROGRA~2\opera\opera.exe" "hxxp://pagego.ru/?from=cru1" ( обфусцирован ) (476 байт.) (MD5:00422C7A91090B568898C853CCC7DC25)
>>> [script][MASK] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Gооgle Сhrоmе.lnk" -> ["C:\ProgramData\lENdmS\vEoRCArLWtRivR0.bat" =>> hxxp://vvv.mystartsearch.com/?type=sc&ts=1445064587&z=e5e957db6bd6fac5fd94758gaz2z8w4e8q9zcw5wdz&from=cmi&uid=ST1000DM003-9YN162_Z1D07XC9XXXXZ1D07XC9] -> chcp 1251 >NUL¶ set /p command1=< "%~dp000"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command2=< "%~dp001"¶ ping 192.0.0.1 -n 1 -w 2 > nul¶ set /p command3=< "%~dp002"¶ ping 192.0.0.1 -n 1 -w 3 > nul¶ set /p command4=< "%~dp003"¶ ping 192.0.0.1 -n 1 -w 5 > nul¶ set /p command5=< "%~dp004"¶ ping 192.0 (532 байт.) (MD5:416F689482B513D66D2E08D1A8383F5F)
>>> [HTTP] "C:\Users\USER\AppData\Roaming\Google Chrome.lnk" -> ["C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" =>> "hxxp://mir-all.ru" "hxxp://startmy.ru"]
>>> [HTTP] "C:\Users\USER\AppData\Roaming\Войти в Интернет.lnk" -> ["C:\Users\USER\AppData\Local\Xpom\Application\chrome.exe" =>> "hxxp://mir-all.ru" "hxxp://startmy.ru"]
>>> "C:\Users\USER\AppData\Roaming\Yandex.lnk" -> ["C:\Users\USER\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" =>> "hxxp://mir-all.ru" "hxxp://startmy.ru"]
>>> [script][s] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks\Wоrld оf Tаnks.lnk" -> ["C:\Users\USER\AppData\Roaming\Browsers\exe.rehcnualtow.bat"] -> start "" "c:\games\WORLD_~1\WOTLAU~1.EXE" "hxxp://pagego.ru/?from=cru1" ( обфусцирован ) (497 байт.) (MD5:E78C74BE4B1C2ADBC4ED4DA996B07E22)
- "C:\Users\USER\AppData\Local\SmartWeb\uninst.lnk" -> ["C:\Users\USER\AppData\Local\SmartWeb\__u.exe" =>> _?=C:\Users\USER\AppData\Local\SmartWeb]
- "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartWeb.lnk" -> ["C:\Users\USER\AppData\Local\SmartWeb\SmartWebHelper.exe"]
- "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\valuablecoupons\valuablecoupons.lnk" -> ["C:\Users\USER\AppData\Local\valuablecoupons\valuablecoupons_stb.exe" =>> /run "C:\Users\USER\AppData\Local\valuablecoupons\config.json"] -> ( CONFIG.JS не существует )
- "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage\Configure.lnk" -> ["C:\Users\USER\AppData\Roaming\VOPackage\VOPackage.exe" =>> /deploy /pac=]
- "C:\Users\USER\Desktop\Continue Mipony Download Manager Installation.lnk" -> ["C:\Users\USER\AppData\Local\Temp\ICReinstall_DownloadManagerSetup.exe" =>> /RR]
- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GAMESDESKTOP\GamesDesktop.lnk" -> ["C:\Program Files (x86)\gmsd_ru_005010123\gamesdesktop_widget.exe"]
- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter\GDSMux.lnk" -> ["C:\Program Files (x86)\Haali\MatroskaSplitter\gdsmux.exe"]
- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter\Uninstall.lnk" -> ["C:\Program Files (x86)\Haali\MatroskaSplitter\uninstall.exe"]
- "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MiPony\MiPony.lnk" -> ["C:\Program Files (x86)\MiPony\MiPony.exe"]
>>> [h] "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk" -> ["C:\Program Files (x86)\Internet Explorer\iexplore.exe"]
>>> [h] "C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk" -> ["C:\Program Files (x86)\Internet Explorer\iexplore.exe"]
-[h] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks\World of Tanks.lnk" -> ["C:\Games\World_of_Tanks\WOTLauncher.exe[/CODE]
Отчёт о работе прикрепите.

Запустите повторно [B]AdwCleaner (by Xplode) [/B](в [B]Windows Vista/7/8[/B] необходимо запускать через правую кнопку мыши [B]от имени администратора)[/B]), нажмите кнопку [B]Сканировать[/B] (Scan), по окончании сканирования уберите галочки на вкладках [B]Папки[/B] (Folders) и [B]Реестр[/B] (Registry) со всех пунктов, где упоминаются Mail.Ru, Amigo и MediaGet [B]если используете соответствующие программы[/B].

В пункте меню "Настройки" (Settings) [B]уберите[/B] галочку "Сброс настроек Winsoсk" и [B][COLOR="#FF0000"]установите[/COLOR][/B] галочку "Сброс политик Chrome".
Затем нажмите [B]Очистка[/B] ([B]Cleaning[/B]) и по окончании удаления перезагрузите систему по требованию программы.

После входа в систему откроется отчёт AdwCleaner - файл AdwCleaner[C1].txt, прикрепите к своему следующему сообщению.

[URL="http://virusinfo.info/showthread.php?t=128635"]Очистите кэш и cookies-файлы браузеров[/URL] и сообщите, что с проблемами.
26.10.2015, 18:33
Антон Лебедев

Вложений: 1

отчет
26.10.2015, 19:50
Vvvyg

Лог очистки AdwCleaner и вердикт по проблеме жду.
26.10.2015, 23:22
Антон Лебедев

Вложений: 1

Лог в приложении, вроде бы все удалилось. По быстродействию пока тяжело сказать, посмотрю. Большое спасибо за помощь.
26.10.2015, 23:35
Vvvyg

Запустите AdwCleaner и нажмите [B]Деинсталлировать (Uninstall)[/B].

Выполните [url="http://virusinfo.info/showthread.php?t=121902"]рекомендации после лечения[/url].
26.10.2015, 23:45
CyberHelper

Итог лечения

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]1[/B][*]Обработано файлов: [B]15[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\program files (x86)\ciplus-4.5vv16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-11.exe - [B]not-a-virus:WebToolbar.Win32.CrossRider.amqa[/B] ( BitDefender: Gen:Application.Heur.ov1@ka@ZeddO )[*] c:\program files (x86)\ciplus-4.5vv16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-1-7.exe - [B]not-a-virus:WebToolbar.Win32.CrossRider.amqa[/B] ( BitDefender: Gen:Application.Heur.dv1@kyFlefnO )[*] c:\program files (x86)\ciplus-4.5vv16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-3.exe - [B]not-a-virus:WebToolbar.Win32.CrossRider.amqa[/B] ( BitDefender: Gen:Application.Heur.ov1@ka@ZeddO )[*] c:\program files (x86)\ciplus-4.5vv16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-5.exe - [B]not-a-virus:WebToolbar.Win32.CrossRider.amqa[/B] ( BitDefender: Gen:Application.Heur.@u1@kOwpjVmO )[*] c:\program files (x86)\ciplus-4.5vv16.10\aedca078-77f9-4ef1-a564-d8b197ab2139-7.exe - [B]not-a-virus:WebToolbar.Win32.CrossRider.amqa[/B] ( BitDefender: Gen:Application.Heur.dv1@kyFlefnO )[*] c:\program files (x86)\ciplus-4.5vv22.10\54e14810-ade6-4c05-8617-cbc4dea65de7-11.exe - [B]not-a-virus:WebToolbar.Win32.CrossRider.amqa[/B] ( BitDefender: Gen:Application.Heur.yv1@ke0I7JpO )[*] c:\program files (x86)\ciplus-4.5vv22.10\54e14810-ade6-4c05-8617-cbc4dea65de7-1-7.exe - [B]not-a-virus:WebToolbar.Win32.CrossRider.amqa[/B] ( BitDefender: Gen:Application.Heur.!u1@kqOy@VeO )[*] c:\program files (x86)\ciplus-4.5vv22.10\54e14810-ade6-4c05-8617-cbc4dea65de7-3.exe - [B]not-a-virus:WebToolbar.Win32.CrossRider.amqa[/B] ( BitDefender: Gen:Application.Heur.yv1@ke0I7JpO )[*] c:\program files (x86)\ciplus-4.5vv22.10\54e14810-ade6-4c05-8617-cbc4dea65de7-5.exe - [B]not-a-virus:WebToolbar.Win32.CrossRider.amqa[/B] ( BitDefender: Gen:Application.Heur.iv1@kGtlxeoO )[*] c:\program files (x86)\ciplus-4.5vv22.10\54e14810-ade6-4c05-8617-cbc4dea65de7-7.exe - [B]not-a-virus:WebToolbar.Win32.CrossRider.amqa[/B] ( BitDefender: Gen:Application.Heur.!u1@kqOy@VeO )[*] c:\program files (x86)\sfk\ssfk.exe - [B]not-a-virus:AdWare.Win32.ELEX.el[/B][*] c:\users\user\appdata\local\46364331-1445075399-4432-4532-3444ffffffff\qnsw9c02.tmp - [B]not-a-virus:AdWare.Win32.ConvertAd.bai[/B] ( AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\users\user\appdata\roaming\zffdy0akt62q05qnt.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.fte[/B][/LIST][/LIST]