Добрый день, компьютер сам по себе перезагрузился и начал устанавливать кучу всяких программ, кое как вычистил, но программы остались.
Было такое один раз, я сам все программы удалили и не предал значения, сейчас снова все установилось, видно где-то что-то осталось.
Уважаемый(ая) [B]Kitsi[/B], спасибо за обращение на наш форум!
Помощь в лечении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в [URL="http://virusinfo.info/pravila.html"]правилах оформления запроса о помощи[/URL].
[INFORMATION]Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом [URL="http://virusinfo.info/content.php?r=613-sub_pomogite"]Помогите+[/URL].[/INFORMATION]
Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста [URL="http://virusinfo.info/content.php?r=113-virusinfo.info-donate"]поддержите проект[/URL].
[url="http://virusinfo.info/showthread.php?t=7239"]Выполните скрипт в AVZ[/url]:[code]begin
TerminateProcessByName('c:\programdata\cloudprinter\cloudprinter.exe');
TerminateProcessByName('C:\Program Files\ContentProtector\ContentProtector.exe');
TerminateProcessByName('C:\Program Files\ContentProtector\ContentProtectorUpdate.exe');
TerminateProcessByName('c:\program files (x86)\88a40b40-1466783054-11dc-b970-1c872c5e430f\hnsv1625.tmp');
TerminateProcessByName('c:\program files (x86)\88a40b40-1466783054-11dc-b970-1c872c5e430f\jnsfbf.tmp');
TerminateProcessByName('c:\users\amidoshka\appdata\roaming\randomdeljihereg.exe');
TerminateProcessByName('c:\programdata\logic handler\set.exe');
TerminateProcessByName('c:\program files (x86)\wifisrv\wifiservice.exe');
StopService('backlh');
StopService('CloudPrinter');
StopService('ContentProtector');
StopService('ContentProtectorUpdate');
StopService('WifiSrv');
StopService('dowidoly');
StopService('rijufoze');
StopService('160WifiNetPro');
StopService('blNetFilter');
StopService('ContentProtectorDrv');
StopService('gkernel');
StopService('KuaiZipDrive');
QuarantineFile('c:\programdata\cloudprinter\cloudprinter.exe', '');
QuarantineFile('C:\Program Files\ContentProtector\ContentProtector.exe', '');
QuarantineFile('C:\Program Files\ContentProtector\ContentProtectorUpdate.exe', '');
QuarantineFile('c:\program files (x86)\88a40b40-1466783054-11dc-b970-1c872c5e430f\hnsv1625.tmp', '');
QuarantineFile('c:\program files (x86)\88a40b40-1466783054-11dc-b970-1c872c5e430f\jnsfbf.tmp', '');
QuarantineFile('c:\users\amidoshka\appdata\roaming\randomdeljihereg.exe', '');
QuarantineFile('c:\programdata\logic handler\set.exe', '');
QuarantineFile('c:\program files (x86)\wifisrv\wifiservice.exe', '');
QuarantineFile('C:\ProgramData\Logic Handler\System.Data.SQLite.dll', '');
QuarantineFile('C:\ProgramData\Logic Handler\x86\SQLite.Interop.dll', '');
QuarantineFile('c:\program files\ziptool\ziphost.dll', '');
QuarantineFile('c:\program files\ziptool\ZipUpdater\ZipUpdate.dll', '');
QuarantineFile('c:\program files\ziptool\CheckUpdate.dll', '');
QuarantineFile('c:\program files\ziptool\ZipSubmit\ZipSubmit.dll', '');
QuarantineFile('c:\program files\ziptool\substat.dll', '');
QuarantineFile('c:\program files\ziptool\ZipPlug.dll', '');
QuarantineFile('c:\program files\ziptool\wchsubstat.dll', '');
QuarantineFile('c:\program files\ziptool\tipsdll.dll', '');
QuarantineFile('c:\program files\їмс№\x86\kuaizipupdatechecker.dll', '');
QuarantineFile('C:\Program Files (x86)\Wifisrv\DtlCrashCatch.dll', '');
QuarantineFile('C:\Program Files (x86)\Wifisrv\libcurl.dll', '');
QuarantineFile('C:\Program Files (x86)\Wifisrv\DTLSubmit\substat.dll', '');
QuarantineFile('C:\Program Files (x86)\Wifisrv\wchsubstat.dll', '');
QuarantineFile('C:\Program Files (x86)\Wifisrv\DtlPlug.dll', '');
QuarantineFile('C:\Program Files (x86)\Wifisrv\tipsdll.dll', '');
QuarantineFile('C:\Program Files (x86)\Wifisrv\appconfig.dll', '');
QuarantineFile('C:\Program Files (x86)\Wifisrv\DTLUpdater\CheckUpdate.dll', '');
QuarantineFile('C:\Program Files (x86)\Wifisrv\dstudp.dll', '');
QuarantineFile('C:\Program Files (x86)\Wifisrv\udp.dll', '');
QuarantineFile('C:\Program Files (x86)\88A40B40-1466783054-11DC-B970-1C872C5E430F\knspE897.tmpfs', '');
QuarantineFile('C:\Program Files (x86)\Wifisrv\160WifiNetPro64.sys', '');
QuarantineFile('C:\Windows\system32\drivers\blNetFilter.sys', '');
QuarantineFile('C:\Windows\system32\drivers\ContentProtectorDrv.sys', '');
QuarantineFile('C:\Users\AMIDOS~1\AppData\Local\Temp\gkernel.sys', '');
QuarantineFile('C:\Windows\system32\drivers\KuaiZipDrive.sys', '');
QuarantineFile('C:\Users\AMIDOS~1\AppData\Local\Temp\supermegabest\setupRun.exe', '');
QuarantineFile('C:\Program Files (x86)\mpck\otutnetwork.exe', '');
QuarantineFile('C:\Program Files (x86)\Hostify\idscservice.exe', '');
QuarantineFile('C:\ProgramData\Lamzap\Trioit.dll', '');
QuarantineFile('C:\Program Files (x86)\badu\uc.exe', '');
QuarantineFile('C:\Program Files (x86)\Hostify\wizzcaster.exe', '');
QuarantineFile('C:\Users\Amidoshka\AppData\Roaming\gplyra\gplyra.exe', '');
QuarantineFile('C:\Users\Amidoshka\AppData\Local\Mail.Ru\MailRuUpdater.exe', '');
QuarantineFile('C:\Users\Amidoshka\AppData\Roaming\UPUpdata\msiql.exe', '');
QuarantineFile('C:\Users\Amidoshka\AppData\Roaming\UPUpdata\service72564.exe', '');
QuarantineFile('C:\Users\Amidoshka\AppData\Roaming\UPUpdata\service90132.exe', '');
QuarantineFile('C:\Program Files (x86)\UCBrowser\Application\UUC0789.exe', '');
QuarantineFile('C:\Program Files (x86)\mpck\wincom_CFT.exe', '');
QuarantineFile('C:\Program Files (x86)\Wifisrv\160WIFI.exe', '');
QuarantineFile('C:\Program Files (x86)\UCBrowser\Application\update_task.exe', '');
QuarantineFile('C:\PROGRA~1\6A8C~1\X86\Update.exe', '');
QuarantineFile('C:\Users\AMIDOS~1\AppData\Local\Temp\VirusRemover.exe', '');
QuarantineFile('C:\Users\AMIDOS~1\AppData\Local\Temp\is-B0JAA.tmp\extract\StubInstallerCleanUp.bat', '');
QuarantineFile('C:\Users\AMIDOS~1\AppData\Local\Temp\is-GH97F.tmp\extract\StubInstallerCleanUp.bat', '');
QuarantineFile('C:\Windows\system32\regsvr32.exe /s /n /i:"/rt" "C:\PROGRA~3\7336ee6b\6e8582fd.dll"', '');
QuarantineFile('C:\PROGRA~3\7336ee6b\6e8582fd.dll', '');
QuarantineFile('C:\Program Files (x86)\UCBrowser\Application\5.6.12150.8\Installer\chrmstp.exe', '');
QuarantineFile('C:\Users\Amidoshka\appdata\roaming\aspackage\uninstall.exe', '');
QuarantineFile('C:\Program Files\contentprotector\libeay32.dll', '');
QuarantineFile('C:\Program Files\contentprotector\ssleay32.dll', '');
DeleteFile('C:\Windows\Tasks\UCBrowserUpdater.job', '64');
DeleteFile('c:\programdata\cloudprinter\cloudprinter.exe', '32');
DeleteFile('C:\Program Files\ContentProtector\ContentProtector.exe', '32');
DeleteFile('C:\Program Files\ContentProtector\ContentProtectorUpdate.exe', '32');
DeleteFile('c:\program files (x86)\88a40b40-1466783054-11dc-b970-1c872c5e430f\hnsv1625.tmp', '32');
DeleteFile('c:\program files (x86)\88a40b40-1466783054-11dc-b970-1c872c5e430f\jnsfbf.tmp', '32');
DeleteFile('c:\users\amidoshka\appdata\roaming\randomdeljihereg.exe', '32');
DeleteFile('c:\programdata\logic handler\set.exe', '32');
DeleteFile('c:\program files (x86)\wifisrv\wifiservice.exe', '32');
DeleteFile('C:\ProgramData\Logic Handler\System.Data.SQLite.dll', '32');
DeleteFile('C:\ProgramData\Logic Handler\x86\SQLite.Interop.dll', '32');
DeleteFile('c:\program files\ziptool\ziphost.dll', '32');
DeleteFile('c:\program files\ziptool\ZipUpdater\ZipUpdate.dll', '32');
DeleteFile('c:\program files\ziptool\CheckUpdate.dll', '32');
DeleteFile('c:\program files\ziptool\ZipSubmit\ZipSubmit.dll', '32');
DeleteFile('c:\program files\ziptool\substat.dll', '32');
DeleteFile('c:\program files\ziptool\ZipPlug.dll', '32');
DeleteFile('c:\program files\ziptool\wchsubstat.dll', '32');
DeleteFile('c:\program files\ziptool\tipsdll.dll', '32');
DeleteFile('c:\program files\їмс№\x86\kuaizipupdatechecker.dll', '32');
DeleteFile('C:\Program Files (x86)\Wifisrv\DtlCrashCatch.dll', '32');
DeleteFile('C:\Program Files (x86)\Wifisrv\libcurl.dll', '32');
DeleteFile('C:\Program Files (x86)\Wifisrv\DTLSubmit\substat.dll', '32');
DeleteFile('C:\Program Files (x86)\Wifisrv\wchsubstat.dll', '32');
DeleteFile('C:\Program Files (x86)\Wifisrv\DtlPlug.dll', '32');
DeleteFile('C:\Program Files (x86)\Wifisrv\tipsdll.dll', '32');
DeleteFile('C:\Program Files (x86)\Wifisrv\appconfig.dll', '32');
DeleteFile('C:\Program Files (x86)\Wifisrv\DTLUpdater\CheckUpdate.dll', '32');
DeleteFile('C:\Program Files (x86)\Wifisrv\dstudp.dll', '32');
DeleteFile('C:\Program Files (x86)\Wifisrv\udp.dll', '32');
DeleteFile('C:\Program Files (x86)\88A40B40-1466783054-11DC-B970-1C872C5E430F\knspE897.tmpfs', '32');
DeleteFile('C:\Program Files (x86)\Wifisrv\160WifiNetPro64.sys', '32');
DeleteFile('C:\Windows\system32\drivers\blNetFilter.sys', '32');
DeleteFile('C:\Windows\system32\drivers\ContentProtectorDrv.sys', '32');
DeleteFile('C:\Users\AMIDOS~1\AppData\Local\Temp\gkernel.sys', '32');
DeleteFile('C:\Windows\system32\drivers\KuaiZipDrive.sys', '32');
DeleteFile('C:\Users\AMIDOS~1\AppData\Local\Temp\supermegabest\setupRun.exe', '32');
DeleteFile('C:\Program Files (x86)\mpck\otutnetwork.exe', '32');
DeleteFile('C:\Program Files (x86)\Hostify\idscservice.exe', '32');
DeleteFile('C:\ProgramData\Lamzap\Trioit.dll', '32');
DeleteFile('C:\Program Files (x86)\badu\uc.exe', '32');
DeleteFile('C:\Program Files (x86)\Hostify\wizzcaster.exe', '32');
DeleteFile('C:\Users\Amidoshka\AppData\Roaming\gplyra\gplyra.exe', '32');
DeleteFile('C:\Users\Amidoshka\AppData\Local\Mail.Ru\MailRuUpdater.exe', '32');
DeleteFile('C:\Users\Amidoshka\AppData\Roaming\UPUpdata\msiql.exe', '32');
DeleteFile('C:\Users\Amidoshka\AppData\Roaming\UPUpdata\service72564.exe', '32');
DeleteFile('C:\Users\Amidoshka\AppData\Roaming\UPUpdata\service90132.exe', '32');
DeleteFile('C:\Program Files (x86)\UCBrowser\Application\UUC0789.exe', '32');
DeleteFile('C:\Program Files (x86)\mpck\wincom_CFT.exe', '32');
DeleteFile('C:\Program Files (x86)\Wifisrv\160WIFI.exe', '32');
DeleteFile('C:\Program Files (x86)\UCBrowser\Application\update_task.exe', '32');
DeleteFile('C:\PROGRA~1\6A8C~1\X86\Update.exe', '32');
DeleteFile('C:\Users\AMIDOS~1\AppData\Local\Temp\VirusRemover.exe', '32');
DeleteFile('C:\Users\AMIDOS~1\AppData\Local\Temp\is-B0JAA.tmp\extract\StubInstallerCleanUp.bat', '32');
DeleteFile('C:\Users\AMIDOS~1\AppData\Local\Temp\is-GH97F.tmp\extract\StubInstallerCleanUp.bat', '32');
DeleteFile('C:\Windows\system32\regsvr32.exe /s /n /i:"/rt" "C:\PROGRA~3\7336ee6b\6e8582fd.dll"', '32');
DeleteFile('C:\PROGRA~3\7336ee6b\6e8582fd.dll', '32');
DeleteFile('C:\Program Files (x86)\UCBrowser\Application\5.6.12150.8\Installer\chrmstp.exe', '32');
DeleteFile('C:\Users\Amidoshka\appdata\roaming\aspackage\uninstall.exe', '32');
DeleteFile('C:\Program Files\contentprotector\libeay32.dll', '32');
DeleteFile('C:\Program Files\contentprotector\ssleay32.dll', '32');
DeleteService('backlh');
DeleteService('CloudPrinter');
DeleteService('ContentProtector');
DeleteService('ContentProtectorUpdate');
DeleteService('WifiSrv');
DeleteService('dowidoly');
DeleteService('rijufoze');
DeleteService('visusypozbt');
DeleteService('160WifiNetPro');
DeleteService('blNetFilter');
DeleteService('ContentProtectorDrv');
DeleteService('gkernel');
DeleteService('KuaiZipDrive');
DeleteFileMask('c:\programdata\cloudprinter', '*', true);
DeleteFileMask('c:\program files\contentprotector', '*', true);
DeleteFileMask('c:\programdata\logic handler', '*', true);
DeleteFileMask('c:\program files (x86)\wifisrv', '*', true);
DeleteFileMask('c:\program files\ziptool', '*', true);
DeleteFileMask('c:\program files\їмс№', '*', true);
DeleteFileMask('c:\users\amidos~1\appdata\local\temp\supermegabest', '*', true);
DeleteFileMask('c:\program files (x86)\mpck', '*', true);
DeleteFileMask('c:\program files (x86)\hostify', '*', true);
DeleteFileMask('c:\programdata\lamzap', '*', true);
DeleteFileMask('c:\program files (x86)\badu', '*', true);
DeleteFileMask('c:\users\amidoshka\appdata\roaming\gplyra', '*', true);
DeleteFileMask('c:\users\amidoshka\appdata\local\mail.ru', '*', true);
DeleteFileMask('c:\users\amidoshka\appdata\roaming\upupdata', '*', true);
DeleteFileMask('c:\program files (x86)\ucbrowser', '*', true);
DeleteFileMask('c:\progra~1\6a8c~1', '*', true);
DeleteFileMask('c:\windows\system32\regsvr32.exe /s /n /i:"/rt" "c:\progra~3\7336ee6b', '*', true);
DeleteFileMask('c:\progra~3\7336ee6b', '*', true);
DeleteFileMask('c:\users\amidoshka\appdata\roaming\aspackage', '*', true);
DeleteDirectory('c:\programdata\cloudprinter');
DeleteDirectory('c:\program files\contentprotector');
DeleteDirectory('c:\programdata\logic handler');
DeleteDirectory('c:\program files (x86)\wifisrv');
DeleteDirectory('c:\program files\ziptool');
DeleteDirectory('c:\program files\їмс№');
DeleteDirectory('c:\users\amidos~1\appdata\local\temp\supermegabest');
DeleteDirectory('c:\program files (x86)\mpck');
DeleteDirectory('c:\program files (x86)\hostify');
DeleteDirectory('c:\programdata\lamzap');
DeleteDirectory('c:\program files (x86)\badu');
DeleteDirectory('c:\users\amidoshka\appdata\roaming\gplyra');
DeleteDirectory('c:\users\amidoshka\appdata\local\mail.ru');
DeleteDirectory('c:\users\amidoshka\appdata\roaming\upupdata');
DeleteDirectory('c:\program files (x86)\ucbrowser');
DeleteDirectory('c:\progra~1\6a8c~1');
DeleteDirectory('c:\windows\system32\regsvr32.exe /s /n /i:"/rt" "c:\progra~3\7336ee6b');
DeleteDirectory('c:\progra~3\7336ee6b');
DeleteDirectory('c:\users\amidoshka\appdata\roaming\aspackage');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "KuaiZip_Update" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "UCBrowserUpdater" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "VirusRemover" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "{121B9F7A-A89C-435C-A175-64D86D3713A9}" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "{35E68735-9AD1-43D5-8AAE-541C0D290692}" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "{56E66705-554F-4231-5484-40415DA9312B}" /F', 0, 15000, true);
ExecuteFile('ipconfig.exe', '/flushdns', 0, 15000, true);
DelCLSID('{65122CB0-EA0F-47DF-A953-017170ED12F9}');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'supermegabest');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Services\KuaizipUpdateChecker\Parameters', 'ServiceDll');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Services\ziphost\Parameters', 'ServiceDll');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'OTUTPRODUCT_GBRIB');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'IDSCPRODUCT');
ExecuteSysClean;
ExecuteRepair(13);
ExecuteRepair(21);
ExecuteRepair(3);
ExecuteRepair(4);
RebootWindows(true);
end.[/code]Компьютер перезагрузится.
Выполните в AVZ скрипт:
[CODE]begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.[/CODE]
В папке с AVZ появится архив карантина quarantine.zip, отправьте этот файл по ссылке "Прислать запрошенный карантин" над над первым сообщением в теме.
Скачайте [URL="http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/"]Farbar Recovery Scan Tool[/URL] и сохраните на Рабочем столе.
Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.
Запустите программу. Когда программа запустится, нажмите Yes для соглашения с предупреждением.
Кроме уже установленных, отметьте галочками также "90 Days Files".
Нажмите кнопку Scan.
После окончания сканирования будут созданы отчеты FRST.txt, Addition.txt в той же папке, откуда была запущена программа.
Прикрепите эти файлы к своему следующему сообщению (можно все в одном архиве).
Результат загрузки
Файл сохранён как 160624_225234_quarantine_576d8f825315e.zip
Размер файла 9793614
MD5 2c0d7347d9176cf14aaa0b9bc791127c
Файл закачан, спасибо!
Откройте Блокнот (Старт =>Программы => Стандартные => Блокнот). Скопируйте в него следующий код:[CODE]CreateRestorePoint:
HKLM-x32\...\RunOnce: [AdBlock2] => [X]
ShellIconOverlayIdentifiers: [JzShlobj] -> {7B286609-DA97-47E1-AC6B-33B8B4732C95} => C:\Program Files\ZipTool\JZipExt.dll No File
HKU\S-1-5-21-1892929375-1140479758-1172115218-500\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBFnYN5R-SRTQR4zPSPgVzx87ub16L9WpSrBPezOQZPHqswBfToCVqyHChoD9AKeDP5YdI1I9J15sGg5D4FdiFT5pnPqzu6X8A3Npc-xB3adDKh0eqsC0byUeImdLk_A5So53CvBLco8fbNt76sVECVlaqOBmaF6qIrySwMDF2Em8zcH1tNoD8JkWGd&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL =
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBFnYN5R-SRTQR4zPSPgVzx87ub16L9WpSrBPezOQZPHqswBfToCVqyHChoD9AKeDP5YdI1I9J15sGg5D4FdiFT5pnPqzu6X8A3Npc-xB3adDKh0eqsC0byUeImdLk_A5So53CvBLco8fbNt76sVECVlaqOBmaF6qIrySwMDF2Em8zcH1tNoD8JkWGd&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1892929375-1140479758-1172115218-500 -> 8E179FC450266D60F4A148009FD4AE9A URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBFnYN5R-SRTQR4zPSPgVzx87ub16L9WpSrBPezOQZPHqswBfToCVqyHChoD9AKeDP5YdI1I9J15sGg5D4FdiFT5pnPqzu6X8A3Npc-xB3adDKh0eqsC0byUeImdLk_A5So53CvBLco8fbNt76sVECVlaqOBmaF6qIrySwMDF2Em8zcH1tNoD8JkWGd&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1892929375-1140479758-1172115218-500 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={SearchTerms}&product_id=%7BE8F42FA0-73A1-45F2-9D57-4D114267137E%7D&gp=822363
FF NewTab: hxxp://www.trotux.com/?z=5e94cfebf3fafe9ac140016g8z7q1q1mabccbg5m8q&from=clc&uid=WDCXWD5001AALS-00J7B0_WD-WMATV850052700527&type=hp
FF DefaultSearchEngine: trotux
FF DefaultSearchEngine.US: data:text/plain,browser.search.defaultenginename.US=trotux
FF SelectedSearchEngine: trotux
FF NetworkProxy: "user_pref("extensions.charles.settings.disabled.network.proxy.http", "");
FF NetworkProxy: "user_pref("extensions.charles.settings.disabled.network.proxy.http_port", 0);
FF NetworkProxy: "user_pref("extensions.charles.settings.disabled.network.proxy.no_proxies_on", "localhost, 127.0.0.1");
FF NetworkProxy: "user_pref("extensions.charles.settings.disabled.network.proxy.share_proxy_settings", false);
FF NetworkProxy: "user_pref("extensions.charles.settings.disabled.network.proxy.socks", "");
FF NetworkProxy: "user_pref("extensions.charles.settings.disabled.network.proxy.socks_port", 0);
FF NetworkProxy: "user_pref("extensions.charles.settings.disabled.network.proxy.ssl", "");
FF NetworkProxy: "user_pref("extensions.charles.settings.disabled.network.proxy.ssl_port", 0);
FF NetworkProxy: "user_pref("extensions.charles.settings.disabled.network.proxy.type", 5);
FF NetworkProxy: "user_pref("extensions.charles.settings.enabled.network.proxy.http", "127.0.0.1");
FF NetworkProxy: "user_pref("extensions.charles.settings.enabled.network.proxy.http_port", 8888);
FF NetworkProxy: "user_pref("extensions.charles.settings.enabled.network.proxy.no_proxies_on", "");
FF NetworkProxy: "user_pref("extensions.charles.settings.enabled.network.proxy.share_proxy_settings", false);
FF NetworkProxy: "user_pref("extensions.charles.settings.enabled.network.proxy.socks", "");
FF NetworkProxy: "user_pref("extensions.charles.settings.enabled.network.proxy.socks_port", 0);
FF NetworkProxy: "user_pref("extensions.charles.settings.enabled.network.proxy.ssl", "127.0.0.1");
FF NetworkProxy: "user_pref("extensions.charles.settings.enabled.network.proxy.ssl_port", 8888);
FF NetworkProxy: "user_pref("extensions.charles.settings.enabled.network.proxy.type", 1);
FF Keyword.URL: hxxp://www.trotux.com/search/?z=5e94cfebf3fafe9ac140016g8z7q1q1mabccbg5m8q&from=clc&uid=WDCXWD5001AALS-00J7B0_WD-WMATV850052700527&type=sp&q=
FF Extension: supermegabest - C:\Users\Amidoshka\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[email protected] [2016-03-21]
FF Extension: FF Extension: Визуальные закладки @Mail.Ru - C:\Users\Amidoshka\AppData\Roaming\Mozilla\Firefox\Profiles\6lsnz2zb.default\Extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7} [2016-06-24]
FF Extension: Домашняя страница Mail.Ru - C:\Users\Amidoshka\AppData\Roaming\Mozilla\Firefox\Profiles\6lsnz2zb.default\Extensions\[email protected] [2016-06-24]
CHR HomePage: atigsykerpiryprewugh -> hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBFnYN5R-SRTQR4zPSPgVzx87ub16L9WpSrBPezOQZPHqswBfToCVqyHChoD9AKeDP5YdI1I9J15sGg5D4FdiFT5pnPqzu6X8AsAfqFPLXJ8jsBIfFcXCLWKnRHBVGaWyCL7R-XlHo_bQTwYDJhgsWkRTewGy3dbEIwZ_rfQAmfrgFVbuC6IaUzSc0L
CHR StartupUrls: atigsykerpiryprewugh -> "hxxp://www.trotux.com/?z=5e94cfebf3fafe9ac140016g8z7q1q1mabccbg5m8q&from=clc&uid=WDCXWD5001AALS-00J7B0_WD-WMATV850052700527&type=hp"
CHR DefaultSearchURL: atigsykerpiryprewugh -> hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBFnYN5R-SRTQR4zPSPgVzx87ub16L9WpSrBPezOQZPHqswBfToCVqyHChoD9AKeDP5YdI1I9J15sGg5D4FdiFT5pnPqzu6X8AgPTlb1qp6GGz4e5f-jH4EUkorNzXjulBNM6bNDJs9ioAuliC-1lp1XKEqj53BWICP6DR3kYFGEIz4PIvdHStJhfZ-&q={searchTerms}
CHR DefaultSearchKeyword: atigsykerpiryprewugh -> feed.sonic-search.com
CHR DefaultSuggestURL: atigsykerpiryprewugh -> hxxps://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}
CHR HKLM\...\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi
CHR HKLM-x32\...\Chrome\Extension: [ahnphcmhmhcjjcjhmnnjjlbmaeljecga] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [aonedlchkbicmhepimiahfalheedjgbh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bejnpnkhfgfkcpgikiinojlmdcjimobi] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ccfifbojenkenpkmnbnndeadpfdiffof] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [cpegcopcfajiiibidlaelhjjblpefbjk] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ehfjihahbphdpljpiadbkmgmhnfehhgi] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ilhapdfjlmhfdgdbefpinebijmhjijpn] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi
CHR HKLM-x32\...\Chrome\Extension: [oelpkepjlgmehajehfeicfbjdiobdkfj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ojlcebdkbpjdpiligkdbbkdkfjmchbfd] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pfigaoamnncijbgomifamkmkidnnlikl] - hxxp://clients2.google.com/service/update2/crx
S2 ziphost; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S2 ziphost; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R1 UCGuard; C:\Windows\System32\DRIVERS\ucguard.sys [80768 2016-04-25] (Huorong Borui (Beijing) Technology Co., Ltd.)
S1 RQueryOncew; system32\drivers\cdmsnrootw_s.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S0 ZCVJEUXVHA; System32\Drivers\askProtect64.sys [X]
2016-06-24 20:28 - 2016-06-24 20:46 - 00000000 ____D C:\ProgramData\ApppazmaL
2016-06-24 19:56 - 2016-06-24 19:56 - 00250912 _____ C:\Windows\SysWOW64\kz.exe
2016-06-24 19:35 - 2016-06-24 19:36 - 00000000 ____D C:\ProgramData\c1493b3f-4341-1
2016-06-24 19:35 - 2016-06-24 19:36 - 00000000 ____D C:\ProgramData\c1493b3f-3535-0
2016-06-24 18:56 - 2016-06-24 18:56 - 00000000 ____D C:\ProgramData\c1493b3f-5cc5-0
2016-06-24 18:56 - 2016-06-24 18:56 - 00000000 ____D C:\ProgramData\c1493b3f-1955-1
2016-06-24 18:56 - 2016-06-24 18:56 - 00000000 ____D C:\ProgramData\41408454-3a25-0
2016-06-24 18:51 - 2016-06-24 18:51 - 00000000 ____D C:\ProgramData\c1493b3f-7ce5-1
2016-06-24 18:51 - 2016-06-24 18:51 - 00000000 ____D C:\ProgramData\c1493b3f-4de5-0
2016-06-24 18:51 - 2016-06-24 18:51 - 00000000 ____D C:\ProgramData\41408454-6de7-0
2016-06-24 18:51 - 2016-06-24 18:51 - 00000000 ____D C:\ProgramData\{0cae247b-512c-1}
2016-06-24 18:51 - 2016-06-24 18:51 - 00000000 ____D C:\ProgramData\{0503f928-612c-0}
2016-06-24 18:49 - 2016-06-24 19:00 - 00000000 ____D C:\Users\Amidoshka\AppData\Roaming\Kuaizip
2016-06-24 18:49 - 2016-06-24 18:49 - 00092872 _____ (WinMount International Inc) C:\Windows\system32\Drivers\KuaiZipDrive.sys
2016-06-24 18:49 - 2016-06-24 18:49 - 00000000 ____D C:\Users\Amidoshka\AppData\Roaming\Softlink
2016-06-24 18:49 - 2016-06-24 18:49 - 00000000 ____D C:\Users\Amidoshka\AppData\Roaming\2dFZW
2016-06-24 18:49 - 2016-06-24 18:49 - 00000000 ____D C:\Users\Amidoshka\AppData\Local\UCBrowser
2016-06-24 18:49 - 2016-06-24 18:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ContentProtector
2016-06-24 18:49 - 2016-06-21 00:50 - 00304223 _____ ( ) C:\Windows\AdBlock.exe
2016-06-24 18:49 - 2016-04-25 21:55 - 00080768 _____ (Huorong Borui (Beijing) Technology Co., Ltd.) C:\Windows\system32\Drivers\ucguard.sys
2016-06-24 18:49 - 2016-02-18 05:56 - 07318464 _____ C:\Users\Amidoshka\AppData\Roaming\KuaiZip_Setup_703612525_zzlm_002.exe
2016-06-24 18:49 - 2015-12-29 20:35 - 00057272 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\ContentProtectorDrv.sys
2016-06-24 18:48 - 2016-06-24 19:29 - 00000000 ____D C:\Users\Amidoshka\AppData\Roaming\MJwel
2016-06-24 18:48 - 2016-06-24 18:48 - 00000000 ____D C:\Users\Все пользователи\160WiFi
2016-06-24 18:48 - 2016-06-24 18:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\USB大师
2016-06-24 18:48 - 2016-06-24 18:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\160WiFi
2016-06-24 18:48 - 2016-06-24 18:48 - 00000000 ____D C:\ProgramData\160WiFi
2016-06-24 18:48 - 2016-06-24 18:48 - 00000000 ____D C:\Program Files (x86)\USBBoxLite
2016-06-24 18:48 - 2016-05-26 11:51 - 04761392 _____ () C:\Users\Amidoshka\AppData\Roaming\usbboxlite_4001_o_8209_hn.exe
2016-06-24 18:48 - 2016-02-18 12:10 - 05267952 _____ () C:\Users\Amidoshka\AppData\Roaming\ziptool_wc-9015_setup.exe
2016-06-24 18:48 - 2015-12-02 05:24 - 00238080 ____R C:\Windows\system32\wifinetinit64.dll
2016-06-24 18:48 - 2015-12-02 05:24 - 00016624 ____R C:\Windows\system32\wifinetmini64.sys
2016-06-24 18:47 - 2016-06-24 19:29 - 00000000 ____D C:\Program Files\Caster
2016-06-24 18:47 - 2016-06-24 18:48 - 00000000 ____D C:\Users\Все пользователи\Lamzaps
2016-06-24 18:47 - 2016-06-24 18:48 - 00000000 ____D C:\ProgramData\Lamzaps
2016-06-24 18:47 - 2016-06-24 18:47 - 06867456 _____ C:\Users\Amidoshka\AppData\Roaming\agent.dat
2016-06-24 18:47 - 2016-06-24 18:47 - 01759888 _____ C:\Users\Amidoshka\AppData\Roaming\Hottam.tst
2016-06-24 18:47 - 2016-06-24 18:47 - 00126464 _____ C:\Users\Amidoshka\AppData\Roaming\noah.dat
2016-06-24 18:47 - 2016-06-24 18:47 - 00126464 _____ C:\Users\Amidoshka\AppData\Roaming\lobby.dat
2016-06-24 18:47 - 2016-06-24 18:47 - 00072704 _____ C:\Users\Amidoshka\AppData\Roaming\Duoit.tst
2016-06-24 18:47 - 2016-06-24 18:47 - 00069024 _____ C:\Users\Amidoshka\AppData\Roaming\Config.xml
2016-06-24 18:47 - 2016-06-24 18:47 - 00054272 _____ C:\Users\Amidoshka\AppData\Roaming\ApplicationHosting.dat
2016-06-24 18:47 - 2016-06-24 18:47 - 00005568 _____ C:\Users\Amidoshka\AppData\Roaming\md.xml
2016-06-24 18:47 - 2016-06-24 18:47 - 00002397 _____ C:\Windows\SysWOW64\findit.xml
2016-06-24 18:47 - 2016-06-24 18:47 - 00000000 ____D C:\Users\Amidoshka\AppData\Local\tuto_monetize_120160624
2016-06-24 18:47 - 2016-06-24 18:47 - 00000000 ____D C:\Users\Amidoshka\AppData\Local\app
2016-06-24 18:47 - 2016-05-16 09:57 - 10167000 _____ (深圳市驱动人生软件技术有限公司) C:\Users\Amidoshka\AppData\Roaming\160wifi_wcid-6089.exe
2016-06-24 18:46 - 2016-06-24 20:17 - 00000000 ____D C:\Program Files (x86)\Shociph
2016-06-24 18:46 - 2016-06-24 18:48 - 00000000 ____D C:\Users\Amidoshka\AppData\Roaming\ADSKIP
2016-06-24 18:46 - 2016-06-24 18:47 - 00018288 _____ C:\Users\Amidoshka\AppData\Roaming\InstallationConfiguration.xml
2016-06-24 18:46 - 2016-06-24 18:47 - 00000000 ____D C:\Users\Amidoshka\AppData\Local\deterghtperjispnernupy
2016-06-24 18:46 - 2016-06-24 18:46 - 00128512 _____ C:\Users\Amidoshka\AppData\Roaming\Installer.dat
2016-06-24 18:46 - 2016-06-24 18:46 - 00000000 ____D C:\Program Files (x86)\Shociph_
2016-06-24 18:44 - 2016-06-24 20:15 - 00000000 ____D C:\Program Files (x86)\88A40B40-1466783054-11DC-B970-1C872C5E430F
2016-06-24 18:44 - 2016-06-24 18:43 - 00001038 _____ C:\Windows\system32\Drivers\etc\hp.bak
2016-06-24 18:41 - 2016-06-24 19:02 - 00000000 ____D C:\Program Files (x86)\Hamster Soft
2016-06-15 18:38 - 2016-06-24 09:05 - 00000000 ____D C:\Users\Все пользователи\ProductData
2016-06-15 18:38 - 2016-06-24 09:05 - 00000000 ____D C:\ProgramData\ProductData
2016-06-15 18:38 - 2016-06-16 18:16 - 00000000 ____D C:\Program Files (x86)\IObit
2016-06-15 18:38 - 2016-06-15 18:39 - 00000000 ____D C:\Users\Все пользователи\IObit
2016-06-15 18:38 - 2016-06-15 18:38 - 00000000 ____D C:\Users\Все пользователи\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
2016-06-15 18:38 - 2016-06-15 18:38 - 00000000 ____D C:\Users\Amidoshka\AppData\Roaming\IObit
2016-06-15 18:38 - 2016-06-15 18:38 - 00000000 ____D C:\Users\Amidoshka\AppData\LocalLow\IObit
2016-06-15 18:38 - 2016-06-15 18:38 - 00000000 ____D C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
2016-06-15 18:36 - 2016-06-15 18:37 - 00000195 _____ C:\Users\Amidoshka\Desktop\Искать в Интернете.url
2016-06-15 18:36 - 2016-06-15 18:37 - 00000000 ____D C:\Users\Все пользователи\Mail.Ru
2016-06-15 18:36 - 2016-06-15 18:37 - 00000000 ____D C:\Users\Amidoshka\AppData\Roaming\MailProducts
2016-06-15 18:36 - 2016-06-15 18:37 - 00000000 ____D C:\ProgramData\Mail.Ru
2016-06-24 18:47 - 2016-05-16 09:57 - 10167000 _____ (深圳市驱动人生软件技术有限公司) C:\Users\Amidoshka\AppData\Roaming\160wifi_wcid-6089.exe
2016-06-24 18:47 - 2016-06-24 18:47 - 6867456 _____ () C:\Users\Amidoshka\AppData\Roaming\agent.dat
2016-06-24 18:47 - 2016-06-24 18:47 - 0054272 _____ () C:\Users\Amidoshka\AppData\Roaming\ApplicationHosting.dat
2016-06-24 18:47 - 2016-06-24 18:47 - 0069024 _____ () C:\Users\Amidoshka\AppData\Roaming\Config.xml
2016-06-24 18:47 - 2016-06-24 18:47 - 0072704 _____ () C:\Users\Amidoshka\AppData\Roaming\Duoit.tst
2016-06-24 18:47 - 2016-06-24 18:47 - 1759888 _____ () C:\Users\Amidoshka\AppData\Roaming\Hottam.tst
2016-06-24 18:46 - 2016-06-24 18:47 - 0018288 _____ () C:\Users\Amidoshka\AppData\Roaming\InstallationConfiguration.xml
2016-06-24 18:46 - 2016-06-24 18:46 - 0128512 _____ () C:\Users\Amidoshka\AppData\Roaming\Installer.dat
2016-06-24 18:49 - 2016-02-18 05:56 - 7318464 _____ () C:\Users\Amidoshka\AppData\Roaming\KuaiZip_Setup_703612525_zzlm_002.exe
2016-06-24 18:47 - 2016-06-24 18:47 - 0126464 _____ () C:\Users\Amidoshka\AppData\Roaming\lobby.dat
2016-06-24 18:47 - 2016-06-24 18:47 - 0005568 _____ () C:\Users\Amidoshka\AppData\Roaming\md.xml
2016-06-24 18:50 - 2016-06-21 14:43 - 48011832 _____ (Maxthon International ltd.) C:\Users\Amidoshka\AppData\Roaming\mx_4bz2016_4.9.3.1000.exe
2016-06-24 18:47 - 2016-06-24 18:47 - 0126464 _____ () C:\Users\Amidoshka\AppData\Roaming\noah.dat
2016-06-14 21:14 - 2016-06-14 21:14 - 0045270 _____ () C:\Users\Amidoshka\AppData\Roaming\room_v3.dat
2016-06-24 18:48 - 2016-06-24 18:48 - 0032038 _____ () C:\Users\Amidoshka\AppData\Roaming\uninstall_temp.ico
2016-06-24 18:48 - 2016-05-26 11:51 - 4761392 _____ () C:\Users\Amidoshka\AppData\Roaming\usbboxlite_4001_o_8209_hn.exe
2016-06-24 18:48 - 2016-02-18 12:10 - 5267952 _____ () C:\Users\Amidoshka\AppData\Roaming\ziptool_wc-9015_setup.exe
Task: {59F492A8-4CD2-4566-A9E8-7A022EA58CF3} - \tasklist -> No File <==== ATTENTION
Task: {763BB676-C636-4BE1-91A3-A10175730EB5} - System32\Tasks\Fisusy Schedule => C:\Program Files (x86)\Shociph\fisusyscheduleRetught.exe [2016-06-24] ()
Task: {7D801650-0573-42F5-92B0-2C5E391AF71E} - \Soft installer -> No File <==== ATTENTION
ShortcutWithArgument: C:\Users\Amidoshka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://yeabests.cc
ShortcutWithArgument: C:\Users\Amidoshka\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://yeabests.cc
ShortcutWithArgument: C:\Users\Amidoshka\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://yeabests.cc
ShortcutWithArgument: C:\Users\Amidoshka\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mail.Ru.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation) -> url,FileProtocolHandler "hxxp://www.mail.ru/cnt/20775012?gp=820313"
ShortcutWithArgument: C:\Users\Amidoshka\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://yeabests.cc
ShortcutWithArgument: C:\Users\Amidoshka\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 1"
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://yeabests.cc
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://yeabests.cc
ShortcutWithArgument: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> D:\Soft\firefox.exe (Mozilla Corporation) -> hxxp://yeabests.cc
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1" /f
Tcpip\Parameters: [NameServer] 82.163.143.171 82.163.142.173
FirewallRules: [UDP Query User{579292A0-5125-421D-94EB-27C6B180FA0B}C:\program files (x86)\adskip\adskip.exe] => (Block) C:\program files (x86)\adskip\adskip.exe
FirewallRules: [{937A3F60-06B2-4389-861D-7CAD86E69A4B}] => (Allow) C:\Program Files (x86)\ADSKIP\ADSkipSvc.exe
FirewallRules: [{03E82AE6-0A7B-47DA-9F9A-D8E752554950}] => (Allow) C:\Program Files (x86)\ADSKIP\ADSkip.exe
FirewallRules: [{8B9EABFD-3C88-404E-8A4B-2936F7A26777}] => (Allow) C:\Program Files (x86)\ADSKIP\ADSkip.exe
FirewallRules: [{207A7306-B71E-4385-874A-32D4DDA3E1CA}] => (Allow) C:\Program Files (x86)\ADSKIP\ADSkipSvc.exe
FirewallRules: [{464E9056-3401-4539-946C-99D2E1BD17F4}] => (Allow) C:\Program Files (x86)\Wifisrv\helptool.exe
FirewallRules: [{F88B6C67-1D88-42A2-99E9-B1E30CF8EEBE}] => (Allow) C:\Program Files (x86)\Wifisrv\YunExplorer.exe
FirewallRules: [{412960E0-5C71-4F19-855C-161CE502EB3C}] => (Allow) C:\Program Files (x86)\Wifisrv\WifiService.exe
FirewallRules: [{06722449-0061-4257-9413-CFEE676A6F90}] => (Allow) C:\Program Files (x86)\Wifisrv\160WiFi.exe
FirewallRules: [{4D1F5AFD-B172-4C72-92EB-DFF8F80CCDD8}] => (Allow) C:\Program Files\UBar\ubar.exe
FirewallRules: [{31325B81-9A55-4721-98C1-738489DE1B00}] => (Allow) C:\Program Files (x86)\Wifisrv\\WifiService.exe
Reg: Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
Reg: Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
CMD: ipconfig /flushdns
23:43 24.06.2016EmptyTemp:
Reboot:[/CODE]
и сохраните как fixlist.txt в папку с Farbar Recovery Scan Tool. [U]При сохранении выберите кодировку [B]Юникод[/B]![/U]
Отключите до перезагрузки антивирус, [U]закройте все браузеры[/U], запустите FRST, нажмите [B]Fix[/B] и подождите. Программа создаст лог-файл ([B]Fixlog.txt[/B]). Прикрепите его к своему следующему сообщению.
Компьютер будет перезагружен автоматически.
Сообщите, что с проблемой.
Программа работала почти 7 часов, нажал кнопку FIX и все, перезагрузок не было, после 7 часов пытался чтото сделать, но компьютер как бы в подвешенном состоянии, пришлось делать горячую перезагрузку, или программа должна фиксить такое количество времени. По проблеме, в браузере открывается подозрительная вкладка, касперский блокирует какие-то попытки, чего-то добавить в атозапуск и на добавление в реестр.
Антивирус на время фикса отключали?
Новые логи Farbar Recovery Scan Tool сделайте.
Да, все выключал
Такой fixlist.txt примените в FRST:[QUOTE]CreateRestorePoint:
R1 UCGuard; C:\Windows\System32\DRIVERS\ucguard.sys [80768 2016-04-25] (Huorong Borui (Beijing) Technology Co., Ltd.)
S1 RQueryOncew; system32\drivers\cdmsnrootw_s.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S0 ZCVJEUXVHA; System32\Drivers\askProtect64.sys [X]
2016-06-24 18:48 - 2016-06-25 20:01 - 00000000 ____D C:\Users\Amidoshka\AppData\Roaming\MJwel
2016-06-24 18:48 - 2016-06-24 18:48 - 00000000 ____D C:\Users\Все пользователи\160WiFi
2016-06-24 18:46 - 2016-06-25 20:01 - 00000000 ____D C:\Program Files (x86)\Shociph_
2016-06-24 18:46 - 2016-06-25 20:01 - 00000000 ____D C:\Program Files (x86)\Shociph
2016-06-24 18:46 - 2016-06-24 18:47 - 00000000 ____D C:\Users\Amidoshka\AppData\Local\deterghtperjispnernupy
2016-06-24 18:46 - 2016-06-24 18:46 - 00128512 _____ C:\Users\Amidoshka\AppData\Roaming\Installer.dat
2016-06-24 18:44 - 2016-06-24 18:43 - 00001038 _____ C:\Windows\system32\Drivers\etc\hp.bak
2016-06-24 18:41 - 2016-06-24 19:02 - 00000000 ____D C:\Program Files (x86)\Hamster Soft
2016-06-15 18:38 - 2016-06-24 09:05 - 00000000 ____D C:\ProgramData\ProductData
2016-06-15 18:38 - 2016-06-16 18:16 - 00000000 ____D C:\Program Files (x86)\IObit
2016-06-15 18:38 - 2016-06-15 18:39 - 00000000 ____D C:\ProgramData\IObit
2016-06-15 18:38 - 2016-06-15 18:38 - 00000000 ____D C:\Windows\Tasks\ImCleanDisabled
2016-06-15 18:38 - 2016-06-15 18:38 - 00000000 ____D C:\Users\Все пользователи\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
2016-06-15 18:38 - 2016-06-15 18:38 - 00000000 ____D C:\Users\Amidoshka\AppData\Roaming\IObit
2016-06-15 18:38 - 2016-06-15 18:38 - 00000000 ____D C:\Users\Amidoshka\AppData\LocalLow\IObit
2016-06-15 18:36 - 2016-06-15 18:37 - 00000195 _____ C:\Users\Amidoshka\Desktop\Искать в Интернете.url
2016-06-15 18:36 - 2016-06-15 18:37 - 00000000 ____D C:\Users\Все пользователи\Mail.Ru
2016-06-15 18:36 - 2016-06-15 18:37 - 00000000 ____D C:\Users\Amidoshka\AppData\Roaming\MailProducts
2016-06-15 18:36 - 2016-06-15 18:37 - 00000000 ____D C:\ProgramData\Mail.Ru
2016-06-24 18:49 - 2016-04-25 21:55 - 00080768 _____ (Huorong Borui (Beijing) Technology Co., Ltd.) C:\Windows\system32\Drivers\ucguard.sys
2016-06-24 18:49 - 2016-06-24 19:00 - 00000000 ____D C:\Users\Amidoshka\AppData\Roaming\Kuaizip
2016-06-24 18:49 - 2016-06-24 18:49 - 00092872 _____ (WinMount International Inc) C:\Windows\system32\Drivers\KuaiZipDrive.sys
2016-06-24 18:49 - 2016-06-24 18:49 - 00000000 ____D C:\Users\Amidoshka\AppData\Roaming\Softlink
2016-06-24 18:49 - 2016-06-24 18:49 - 00000000 ____D C:\Users\Amidoshka\AppData\Roaming\2dFZW
2016-06-24 18:49 - 2016-06-24 18:49 - 00000000 ____D C:\Users\Amidoshka\AppData\Local\UCBrowser
Task: {7D801650-0573-42F5-92B0-2C5E391AF71E} - \Soft installer -> No File <==== ATTENTION
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gplyra" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MailRuUpdatera" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\msiql" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QGuan10in1" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QGuan10in12" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\svchost0" /f
EmptyTemp:
Reboot:[/QUOTE]
После перезагрузки прикрепите Fixlog.txt.
тоже все зависает и не помогает фикс
Повторите фикс в безопасном режиме.
Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]1[/B][*]Обработано файлов: [B]29[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\program files (x86)\badu\uc.exe - [B]not-a-virus:RiskTool.Win32.Hidap.ah[/B] ( AVAST4: Win32:Malware-gen )[*] c:\program files\contentprotector\contentprotector.exe - [B]not-a-virus:NetTool.Win64.NetFilter.jd[/B][*] c:\program files\contentprotector\contentprotectorupdate.exe - [B]not-a-virus:NetTool.Win64.NetFilter.jd[/B][*] c:\program files\contentprotector\libeay32.dll - [B]not-a-virus:NetTool.Win64.NetFilter.jd[/B][*] c:\program files\contentprotector\ssleay32.dll - [B]not-a-virus:NetTool.Win64.NetFilter.jd[/B][*] c:\programdata\cloudprinter\cloudprinter.exe - [B]not-a-virus:HEUR:WebToolbar.Win32.Linkury.gen[/B] ( AVAST4: Win32:Dropper-gen [Drp] )[*] c:\progra~3\7336ee6b\6e8582fd.dll - [B]not-a-virus:AdWare.Win32.Adposhel.a[/B] ( AVAST4: Win32:Adware-gen [Adw] )[*] c:\users\amidoshka\appdata\roaming\upupdata\service90132.exe - [B]Trojan.Win32.Vimditator.vqn[/B] ( AVAST4: Win32:Adware-gen [Adw] )[*] c:\windows\system32\drivers\contentprotectordrv.sys - [B]not-a-virus:NetTool.Win64.NetFilter.lf[/B][/LIST][/LIST]