Амиго и прочая хренотень.

**AntiGM** · 13.12.2017, 15:13

Вообщем всё как у всех. Не углядел и вроде с относительно достойного файлообменника запустил самараспаковывающийся архив с нужной для меня информацией. А кроме неё я получил подарочек от майл ру групп.
Кроме стандартных проблем с фмиго и прочими гвардами и агентами добавилось эже секундное открывание всяких вкладок во все браузерах. (у Меня браузеров оч много стало

)))
помогите люди Добрые. Обещаю, что такого больше не повторится. И по порно сайтам я не лазил. Только по тем, что проверенны годами.

Надоело быть жертвой? Стань профи по информационной безопасности, получай самую свежую информацию об угрозах и средствах защиты от ведущего российского аналитического центра Anti-Malware.ru:

**Info_bot** · 13.12.2017, 15:15

Уважаемый(ая) AntiGM, спасибо за обращение на наш форум!

Удаление вирусов - абсолютно бесплатная услуга на VirusInfo.Info. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитой Autologger, подробнее можно прочитать в правилах оформления запроса о помощи.

Информация

Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом Помогите+.

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

**lex0819** · 14.12.2017, 13:52

Здравствуйте!

1. Скачайте ClearLNK и сохраните архив с утилитой на Рабочем столе.
* Распакуйте архив с утилитой в отдельную папку.
* Перенесите файл Check_Browsers_LNK.log из логов на ClearLNK как показано на рисунке

* Отчет о работе ClearLNK-<Дата>.log будет сохранен в папке LOG.
* Прикрепите этот отчет к своему следующему сообщению.

2. Пофиксите в HiJackThis.
Сама программа HiJackThis находится в папке AutoLogger, в подпапке HiJackThis

Код:

O20 - AppInit_DLLs: C:\ProgramData\Voyasollam\K--In.dll
O20-32 - AppInit_DLLs: C:\ProgramData\Voyasollam\Villatamfax.dll
O20-32 - Winlogon Notify: swidfir - C:\Users\ANtiGM\AppData\Local\swidfir.dll

3. Выполните скрипт AVZ.

Код:

begin
 QuarantineFile('C:\Users\ANtiGM\appdata\local\pcbooster\booster.exe','');
 QuarantineFile('C:\Windows\windefender.exe','');
 QuarantineFile('c:\users\antigm\appdata\local\swidfir.dll','');
 QuarantineFile('C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe','');
 QuarantineFile('C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe','');
 QuarantineFile('C:\Program Files (x86)\Launcher for Windows\winlaunch.exe','');
 QuarantineFile('C:\Disk\WebService.exe','');
 QuarantineFile('C:\Program Files (x86)\vknAtWNPMhpU2\xhGbJvNntxoDj.dll','');
 QuarantineFile('C:\Program Files (x86)\ExRIRmygU\hbvnxD.dll','');
 QuarantineFile('C:\Program Files (x86)\OGqwJxyzdjgEZIvrFER\KBjHMfD.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\KCJMBzuP7\ytab_m_1_big.exe','');
 DelBHO('{C0D38E5A-7CF8-4105-8FE8-31B81443A114}');
 QuarantineFile('C:\Program Files\AF4JPKEW89\GP5J69GKH.exe','');
 QuarantineFile('C:\Program Files\GUGCB9K48G\GUGCB9K48.exe','');
 QuarantineFile('C:\Program Files (x86)\systemtools\systemtools.exe','');
 QuarantineFile('C:\Program Files (x86)\p1hnblxjgxi\BBBF0.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Optimizer\Optimizer.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\MediaPlayerApplication\MediaPlayerApplication.exe','');
 QuarantineFile('C:\Windows\rss\csrss.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe','');
 QuarantineFile('C:\Program Files\8A6Q2RZFDU\8A6Q2RZFD.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\PCBooster\booster.exe','');
 QuarantineFile('C:\Program Files\NWLJDMXNMW\0LRYLL3OM.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\gszixkjqzeg\c4cpto44yde.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\wsizbbmm3re\gajyrcdbj23.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\ymf5pgkf2kx\4m1psgn5fxc.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\k21reg1ohy2\ntesa4q0sx1.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\iaibrsqmjg0\hqjkcop12vo.exe','');
 QuarantineFile('C:\Program Files\9FXT9MDQFD\9FXT9MDQF.exe','');
 QuarantineFile('C:\Program Files\KSPF1ABA8J\KSPF1ABA8.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\4sgh2com2pg\tiuwbyf1z0h.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\4ytj50xjh2d\tgvvjqqaetw.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\iixb1vlg3qa\u4gwoylatex.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\hdyuthkcoqo\nnzxi3ogkez.exe','');
 QuarantineFile('C:\Program Files\YCGNAU9W7Z\YCGNAU9W7.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\vboddauunih\fhj0kjuozpo.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\hdvnrnwz4rf\uddlwgjlari.exe','');
 QuarantineFile('C:\ProgramData\Voyasollam\K--In.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-ABDTI.tmp\up.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\AdService\AdService.dll','');
 QuarantineFile('C:\ProgramData\Voyasollam\Villatamfax.dll','');
 QuarantineFile('C:\Program Files\4Z0FK8ZJL9\YEHMCCP2G.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\ygkoseyjdea\dafbtjrbkkp.exe','');
 QuarantineFile('C:\Program Files\LOXDMGHPZ5\LOXDMGHPZ.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\n5dzptn0e4u\nentt5q0vlc.exe','');
 QuarantineFile('C:\Program Files\FJLYU6ZAFT\FJLYU6ZAF.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\b00lphedo2h\zfnpzsev3vi.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\nlxp0ri4bva\ib2jkdioijj.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\zzhxudplh0x\rpyhnfgw1cz.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\cbix4z3v1fe\sp1fzcyaztj.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\w4o55y0jbzi\pnmj0iawa3x.exe','');
 QuarantineFile('C:\Program Files\H3O4USA771\H3O4USA77.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\ev5404ycjpf\lwik4dccniv.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\w0pqldybim0\44juibhmz1f.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\5cigdrjxsyd\430i4znn5p4.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\ffzqrocd0wo\tmk5hfqu3vi.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\c5ejf4ios3h\hm0o5c5ckyq.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\blkhs1e4pdp\otv1kdzi4uk.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\bci0mduoma0\c0xxisieu3d.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\fa0r0wa2khc\oowybgcy5uh.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\23bmunv4eib\qutbyiibk3u.exe','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Roaming\3filphq22lw\fcpfkcsrdlv.exe','');
 DeleteService('WinMon');
 StopService('WinMon');
 DeleteService('Voyasollam');
 StopService('Voyasollam');
 QuarantineFile('C:\ProgramData\Voyasollam\Voyasollam.exe','');
 DeleteService('tiser');
 StopService('tiser');
 QuarantineFile('C:\ProgramData\tiser\run.exe','');
 DeleteService('Nettrans');
 StopService('Nettrans');
 QuarantineFile('C:\ProgramData\PrefsSecure\Nettrans.exe','');
 DeleteService('backlh');
 StopService('backlh');
 QuarantineFile('C:\ProgramData\Logic Cramble\set.exe','');
 DeleteService('WinDefender');
 StopService('WinDefender');
 QuarantineFile('C:\Windows\system32\ntkrnlmp.exe','');
 QuarantineFile('C:\Windows\System32\drivers\Winmon.sys','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-VGNK4.tmp\idp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-TKU51.tmp\idp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-QPEV1.tmp\idp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-PI0KH.tmp\idp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-KCAUP.tmp\idp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-JT4SC.tmp\idp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-ITC7A.tmp\idp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-I85CM.tmp\_isetup\_isdecmp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-ELSAG.tmp\idp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-DNPUK.tmp\idp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-AS3BU.tmp\idp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-7GQ7O.tmp\_isetup\_isdecmp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-5Q0AT.tmp\idp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-4I0JT.tmp\idp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-20D5L.tmp\idp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-0VL0P.tmp\idp.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\swidfir.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Amigo\Application\58.0.3029.160\libglesv2.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Amigo\Application\58.0.3029.160\libegl.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Amigo\Application\58.0.3029.160\chrome_elf.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Amigo\Application\58.0.3029.160\chrome_child.dll','');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Amigo\Application\58.0.3029.160\chrome.dll','');
 QuarantineFile('c:\users\antigm\appdata\local\adservice\adservice.dll','');
 QuarantineFile('C:\Program Files (x86)\gVEKLTxUjIE\kcIVrHC.dll','');
 QuarantineFile('C:\Program Files (x86)\gVEKLTxUjIE\iwq335.dll','');
 QuarantineFile('C:\Program Files\ZLGJSFXDQ8\ZLGJSFXDQ.exe','');
 TerminateProcessByName('C:\Program Files\ZLGJSFXDQ8\ZLGJSFXDQ.exe');
 QuarantineFile('C:\Program Files\YOZZO4UP3C\YOZZO4UP3.exe','');
 TerminateProcessByName('C:\Program Files\YOZZO4UP3C\YOZZO4UP3.exe');
 QuarantineFile('C:\Program Files\XES969EYWI\XES969EYW.exe','');
 TerminateProcessByName('C:\Program Files\XES969EYWI\XES969EYW.exe');
 QuarantineFile('C:\Program Files\XALC701JVQ\XALC701JV.exe','');
 TerminateProcessByName('C:\Program Files\XALC701JVQ\XALC701JV.exe');
 QuarantineFile('C:\Program Files (x86)\p1hnblxjgxi\X2D8L8RADF45RGV.exe','');
 TerminateProcessByName('C:\Program Files (x86)\p1hnblxjgxi\X2D8L8RADF45RGV.exe');
 QuarantineFile('c:\program files (x86)\launcher for windows\winlaunch.exe','');
 TerminateProcessByName('c:\program files (x86)\launcher for windows\winlaunch.exe');
 QuarantineFile('c:\windows\windefender.exe','');
 TerminateProcessByName('c:\windows\windefender.exe');
 QuarantineFile('c:\disk\webser~1.exe','');
 TerminateProcessByName('c:\disk\webser~1.exe');
 QuarantineFile('c:\disk\webservice.exe','');
 TerminateProcessByName('c:\disk\webservice.exe');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Temp\is-UEF14.tmp\up.exe','');
 TerminateProcessByName('C:\Users\ANtiGM\AppData\Local\Temp\is-UEF14.tmp\up.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-abdti.tmp\up(z).exe','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-abdti.tmp\up(z).exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-9qkst.tmp\uddlwgjlari.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-9qkst.tmp\uddlwgjlari.tmp');
 QuarantineFile('c:\users\antigm\appdata\roaming\hdvnrnwz4rf\uddlwgjlari.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\roaming\hdvnrnwz4rf\uddlwgjlari.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-vibej.tmp\tmk5hfqu3vi.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-vibej.tmp\tmk5hfqu3vi.tmp');
 QuarantineFile('c:\users\antigm\appdata\roaming\ffzqrocd0wo\tmk5hfqu3vi.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\roaming\ffzqrocd0wo\tmk5hfqu3vi.exe');
 QuarantineFile('C:\Disk\securedisk.exe','');
 TerminateProcessByName('C:\Disk\securedisk.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-q2a4c.tmp\rcvavzlou.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-q2a4c.tmp\rcvavzlou.tmp');
 QuarantineFile('c:\users\antigm\appdata\local\temp\rcvavzlou\rcvavzlou.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\rcvavzlou\rcvavzlou.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-789su.tmp\qutbyiibk3u.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-789su.tmp\qutbyiibk3u.tmp');
 QuarantineFile('c:\users\antigm\appdata\roaming\23bmunv4eib\qutbyiibk3u.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\roaming\23bmunv4eib\qutbyiibk3u.exe');
 QuarantineFile('c:\program files (x86)\gvekltxujie\plxoqsndww.exe','');
 TerminateProcessByName('c:\program files (x86)\gvekltxujie\plxoqsndww.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-b5ooc.tmp\otv1kdzi4uk.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-b5ooc.tmp\otv1kdzi4uk.tmp');
 QuarantineFile('c:\users\antigm\appdata\roaming\blkhs1e4pdp\otv1kdzi4uk.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\roaming\blkhs1e4pdp\otv1kdzi4uk.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-6dc6c.tmp\oowybgcy5uh.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-6dc6c.tmp\oowybgcy5uh.tmp');
 QuarantineFile('c:\users\antigm\appdata\roaming\fa0r0wa2khc\oowybgcy5uh.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\roaming\fa0r0wa2khc\oowybgcy5uh.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-sma8p.tmp\nnzxi3ogkez.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-sma8p.tmp\nnzxi3ogkez.tmp');
 QuarantineFile('c:\users\antigm\appdata\roaming\hdyuthkcoqo\nnzxi3ogkez.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\roaming\hdyuthkcoqo\nnzxi3ogkez.exe');
 QuarantineFile('C:\Program Files\N4XZIIRSM8\N4XZIIRSM.exe','');
 TerminateProcessByName('C:\Program Files\N4XZIIRSM8\N4XZIIRSM.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-4h743.tmp\ml53gtq67.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-4h743.tmp\ml53gtq67.tmp');
 QuarantineFile('c:\users\antigm\appdata\local\temp\ml53gtq67\ml53gtq67.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\ml53gtq67\ml53gtq67.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\u1fj9ml4j\mailruhomesearch.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\u1fj9ml4j\mailruhomesearch.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\qrmmrtv65\mailruhomesearch.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\qrmmrtv65\mailruhomesearch.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\xp6eru5kl\mailruhomesearch.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\xp6eru5kl\mailruhomesearch.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-5bmil.tmp\lwik4dccniv.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-5bmil.tmp\lwik4dccniv.tmp');
 QuarantineFile('c:\users\antigm\appdata\roaming\ev5404ycjpf\lwik4dccniv.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\roaming\ev5404ycjpf\lwik4dccniv.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-tdj8i.tmp\hqjkcop12vo.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-tdj8i.tmp\hqjkcop12vo.tmp');
 QuarantineFile('c:\users\antigm\appdata\roaming\iaibrsqmjg0\hqjkcop12vo.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\roaming\iaibrsqmjg0\hqjkcop12vo.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-h282b.tmp\hm0o5c5ckyq.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-h282b.tmp\hm0o5c5ckyq.tmp');
 QuarantineFile('c:\users\antigm\appdata\roaming\c5ejf4ios3h\hm0o5c5ckyq.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\roaming\c5ejf4ios3h\hm0o5c5ckyq.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-udbi9.tmp\fcpfkcsrdlv.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-udbi9.tmp\fcpfkcsrdlv.tmp');
 QuarantineFile('c:\users\antigm\appdata\roaming\3filphq22lw\fcpfkcsrdlv.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\roaming\3filphq22lw\fcpfkcsrdlv.exe');
 QuarantineFile('c:\windows\rss\csrss.exe','');
 TerminateProcessByName('c:\windows\rss\csrss.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\csrss\cloudnet.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\csrss\cloudnet.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-s746c.tmp\c4cpto44yde.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-s746c.tmp\c4cpto44yde.tmp');
 QuarantineFile('c:\users\antigm\appdata\roaming\gszixkjqzeg\c4cpto44yde.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\roaming\gszixkjqzeg\c4cpto44yde.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-6bfdp.tmp\c0xxisieu3d.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-6bfdp.tmp\c0xxisieu3d.tmp');
 QuarantineFile('c:\users\antigm\appdata\roaming\bci0mduoma0\c0xxisieu3d.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\roaming\bci0mduoma0\c0xxisieu3d.exe');
 QuarantineFile('C:\Users\ANtiGM\AppData\Local\Amigo\Application\amigo.exe','');
 TerminateProcessByName('C:\Users\ANtiGM\AppData\Local\Amigo\Application\amigo.exe');
 QuarantineFile('c:\users\antigm\appdata\local\amigo\application\amigo.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\local\amigo\application\amigo.exe');
 QuarantineFile('C:\Program Files\A4NBBHE8VX\A4NBBHE8V.exe','');
 TerminateProcessByName('C:\Program Files\A4NBBHE8VX\A4NBBHE8V.exe');
 QuarantineFile('C:\Program Files\9PA1M9MEJS\9PA1M9MEJ.exe','');
 TerminateProcessByName('C:\Program Files\9PA1M9MEJS\9PA1M9MEJ.exe');
 QuarantineFile('C:\Program Files\5ZVO9UH5N2\5ZVO9UH5N.exe','');
 TerminateProcessByName('C:\Program Files\5ZVO9UH5N2\5ZVO9UH5N.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-iu84n.tmp\4rziwmbql.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-iu84n.tmp\4rziwmbql.tmp');
 QuarantineFile('c:\users\antigm\appdata\local\temp\4rziwmbql\4rziwmbql.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\4rziwmbql\4rziwmbql.exe');
 QuarantineFile('C:\Program Files\45N9ZU2WQS\45N9ZU2WQ.exe','');
 TerminateProcessByName('C:\Program Files\45N9ZU2WQS\45N9ZU2WQ.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-2sep3.tmp\44juibhmz1f.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-2sep3.tmp\44juibhmz1f.tmp');
 QuarantineFile('c:\users\antigm\appdata\roaming\w0pqldybim0\44juibhmz1f.exe','');
 TerminateProcessByName('c:\users\antigm\appdata\roaming\w0pqldybim0\44juibhmz1f.exe');
 QuarantineFile('c:\users\antigm\appdata\local\temp\is-9rrim.tmp\430i4znn5p4.tmp','');
 TerminateProcessByName('c:\users\antigm\appdata\local\temp\is-9rrim.tmp\430i4znn5p4.tmp');
 TerminateProcessByName('c:\users\antigm\appdata\roaming\5cigdrjxsyd\430i4znn5p4.exe');
 QuarantineFile('c:\users\antigm\appdata\roaming\5cigdrjxsyd\430i4znn5p4.exe','');
 TerminateProcessByName('C:\Program Files\17QXIYE6ND\17QXIYE6N.exe');
 QuarantineFile('C:\Program Files\17QXIYE6ND\17QXIYE6N.exe','');
 DeleteFile('C:\Program Files\17QXIYE6ND\17QXIYE6N.exe','32');
 DeleteFile('c:\users\antigm\appdata\roaming\5cigdrjxsyd\430i4znn5p4.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-9rrim.tmp\430i4znn5p4.tmp','32');
 DeleteFile('c:\users\antigm\appdata\roaming\w0pqldybim0\44juibhmz1f.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-2sep3.tmp\44juibhmz1f.tmp','32');
 DeleteFile('C:\Program Files\45N9ZU2WQS\45N9ZU2WQ.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\4rziwmbql\4rziwmbql.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-iu84n.tmp\4rziwmbql.tmp','32');
 DeleteFile('C:\Program Files\5ZVO9UH5N2\5ZVO9UH5N.exe','32');
 DeleteFile('C:\Program Files\9PA1M9MEJS\9PA1M9MEJ.exe','32');
 DeleteFile('C:\Program Files\A4NBBHE8VX\A4NBBHE8V.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\amigo\application\amigo.exe','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Amigo\Application\amigo.exe','32');
 DeleteFile('c:\users\antigm\appdata\roaming\bci0mduoma0\c0xxisieu3d.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-6bfdp.tmp\c0xxisieu3d.tmp','32');
 DeleteFile('c:\users\antigm\appdata\roaming\gszixkjqzeg\c4cpto44yde.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-s746c.tmp\c4cpto44yde.tmp','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\csrss\cloudnet.exe','32');
 DeleteFile('c:\windows\rss\csrss.exe','32');
 DeleteFile('c:\users\antigm\appdata\roaming\3filphq22lw\fcpfkcsrdlv.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-udbi9.tmp\fcpfkcsrdlv.tmp','32');
 DeleteFile('c:\users\antigm\appdata\roaming\c5ejf4ios3h\hm0o5c5ckyq.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-h282b.tmp\hm0o5c5ckyq.tmp','32');
 DeleteFile('c:\users\antigm\appdata\roaming\iaibrsqmjg0\hqjkcop12vo.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-tdj8i.tmp\hqjkcop12vo.tmp','32');
 DeleteFile('c:\users\antigm\appdata\roaming\ev5404ycjpf\lwik4dccniv.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-5bmil.tmp\lwik4dccniv.tmp','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\xp6eru5kl\mailruhomesearch.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\qrmmrtv65\mailruhomesearch.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\u1fj9ml4j\mailruhomesearch.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\ml53gtq67\ml53gtq67.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-4h743.tmp\ml53gtq67.tmp','32');
 DeleteFile('C:\Program Files\N4XZIIRSM8\N4XZIIRSM.exe','32');
 DeleteFile('c:\users\antigm\appdata\roaming\hdyuthkcoqo\nnzxi3ogkez.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-sma8p.tmp\nnzxi3ogkez.tmp','32');
 DeleteFile('c:\users\antigm\appdata\roaming\fa0r0wa2khc\oowybgcy5uh.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-6dc6c.tmp\oowybgcy5uh.tmp','32');
 DeleteFile('c:\users\antigm\appdata\roaming\blkhs1e4pdp\otv1kdzi4uk.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-b5ooc.tmp\otv1kdzi4uk.tmp','32');
 DeleteFile('c:\program files (x86)\gvekltxujie\plxoqsndww.exe','32');
 DeleteFile('c:\users\antigm\appdata\roaming\23bmunv4eib\qutbyiibk3u.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-789su.tmp\qutbyiibk3u.tmp','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\rcvavzlou\rcvavzlou.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-q2a4c.tmp\rcvavzlou.tmp','32');
 DeleteFile('C:\Disk\securedisk.exe','32');
 DeleteFile('c:\users\antigm\appdata\roaming\ffzqrocd0wo\tmk5hfqu3vi.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-vibej.tmp\tmk5hfqu3vi.tmp','32');
 DeleteFile('c:\users\antigm\appdata\roaming\hdvnrnwz4rf\uddlwgjlari.exe','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-9qkst.tmp\uddlwgjlari.tmp','32');
 DeleteFile('c:\users\antigm\appdata\local\temp\is-abdti.tmp\up(z).exe','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-UEF14.tmp\up.exe','32');
 DeleteFile('c:\disk\webservice.exe','32');
 DeleteFile('c:\disk\webser~1.exe','32');
 DeleteFile('c:\windows\windefender.exe','32');
 DeleteFile('c:\program files (x86)\launcher for windows\winlaunch.exe','32');
 DeleteFile('C:\Program Files (x86)\p1hnblxjgxi\X2D8L8RADF45RGV.exe','32');
 DeleteFile('C:\Program Files\XALC701JVQ\XALC701JV.exe','32');
 DeleteFile('C:\Program Files\XES969EYWI\XES969EYW.exe','32');
 DeleteFile('C:\Program Files\YOZZO4UP3C\YOZZO4UP3.exe','32');
 DeleteFile('C:\Program Files\ZLGJSFXDQ8\ZLGJSFXDQ.exe','32');
 DeleteFile('C:\Program Files (x86)\gVEKLTxUjIE\iwq335.dll','32');
 DeleteFile('C:\Program Files (x86)\gVEKLTxUjIE\kcIVrHC.dll','32');
 DeleteFile('c:\users\antigm\appdata\local\adservice\adservice.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Amigo\Application\58.0.3029.160\chrome.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Amigo\Application\58.0.3029.160\chrome_child.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Amigo\Application\58.0.3029.160\chrome_elf.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Amigo\Application\58.0.3029.160\libegl.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Amigo\Application\58.0.3029.160\libglesv2.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\swidfir.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-0VL0P.tmp\idp.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-20D5L.tmp\idp.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-4I0JT.tmp\idp.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-5Q0AT.tmp\idp.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-7GQ7O.tmp\_isetup\_isdecmp.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-AS3BU.tmp\idp.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-DNPUK.tmp\idp.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-ELSAG.tmp\idp.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-I85CM.tmp\_isetup\_isdecmp.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-ITC7A.tmp\idp.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-JT4SC.tmp\idp.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-KCAUP.tmp\idp.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-PI0KH.tmp\idp.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-QPEV1.tmp\idp.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-TKU51.tmp\idp.dll','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-VGNK4.tmp\idp.dll','32');
 DeleteFile('C:\ProgramData\Logic Cramble\set.exe','32');
 DeleteFile('C:\ProgramData\PrefsSecure\Nettrans.exe','32');
 DeleteFile('C:\ProgramData\tiser\run.exe','32');
 DeleteFile('C:\ProgramData\Voyasollam\Voyasollam.exe','32');
 DeleteFile('C:\Windows\System32\drivers\Winmon.sys','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','mailruhomesearch');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Mail.Ru\Sputnik\ptls\mailruhomesearch.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','6800217');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\3filphq22lw\fcpfkcsrdlv.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','5881308');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\23bmunv4eib\qutbyiibk3u.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','KU8PDSZSS79ITZK');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','1893920');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\fa0r0wa2khc\oowybgcy5uh.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','0HJYNW2MZ0T47PT');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','amigo');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','F4D2RY62LGF6X0H');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','4138918');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\bci0mduoma0\c0xxisieu3d.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','1421587');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\blkhs1e4pdp\otv1kdzi4uk.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','3128220');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\c5ejf4ios3h\hm0o5c5ckyq.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','9377039');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\ffzqrocd0wo\tmk5hfqu3vi.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','ROJHHFZ29GIJXTU');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','PFV0BXOHU99UOX4');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','swidfir');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','4371771');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\5cigdrjxsyd\430i4znn5p4.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','6931682');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\w0pqldybim0\44juibhmz1f.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','0Q393NBM5290UUQ');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','6731549');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\ev5404ycjpf\lwik4dccniv.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','OQM60KAD61DW43Q');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','W0RXL4OQ7AJ9IMF');
 DeleteFile('C:\Program Files\H3O4USA771\H3O4USA77.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','5677676');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\w4o55y0jbzi\pnmj0iawa3x.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','4237157');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\cbix4z3v1fe\sp1fzcyaztj.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','4036986');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\zzhxudplh0x\rpyhnfgw1cz.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','2862153');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\nlxp0ri4bva\ib2jkdioijj.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','2816278');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\b00lphedo2h\zfnpzsev3vi.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','VIW58CRFQ3J7B1Q');
 DeleteFile('C:\Program Files\FJLYU6ZAFT\FJLYU6ZAF.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','4670609');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\n5dzptn0e4u\nentt5q0vlc.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','9CPBRKBP4TCI3MQ');
 DeleteFile('C:\Program Files\LOXDMGHPZ5\LOXDMGHPZ.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','4749476');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\ygkoseyjdea\dafbtjrbkkp.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','VNOBDMTDDN2AKAD');
 DeleteFile('C:\Program Files\4Z0FK8ZJL9\YEHMCCP2G.exe','32');
 DeleteFile('C:\ProgramData\Voyasollam\Villatamfax.dll','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\swidfir','DLLName');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\HNService\Parameters','ServiceDll');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\AdService\AdService.dll','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\RunOnce','OMEWPRODUCT_A5CHV');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\RunOnce','OMEWPRODUCT_BWO71');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\RunOnce','OMEWPRODUCT_38DUY');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\is-ABDTI.tmp\up.exe','32');
 DeleteFile('C:\ProgramData\Voyasollam\K--In.dll','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\2104000','command');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\hdvnrnwz4rf\uddlwgjlari.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\2561531','command');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\vboddauunih\fhj0kjuozpo.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\2OXGKQSCQMV84AJ','command');
 DeleteFile('C:\Program Files\YCGNAU9W7Z\YCGNAU9W7.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\3072102','command');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\hdyuthkcoqo\nnzxi3ogkez.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\3606972','command');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\iixb1vlg3qa\u4gwoylatex.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\5078494','command');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\4ytj50xjh2d\tgvvjqqaetw.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\5432455','command');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\4sgh2com2pg\tiuwbyf1z0h.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\5L1R91PDY2I6OZ7','command');
 DeleteFile('C:\Program Files\KSPF1ABA8J\KSPF1ABA8.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\5TGN5A7HEWXCU2H','command');
 DeleteFile('C:\Program Files\9FXT9MDQFD\9FXT9MDQF.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\7348406','command');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\iaibrsqmjg0\hqjkcop12vo.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\7812223','command');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\k21reg1ohy2\ntesa4q0sx1.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\8471416','command');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\ymf5pgkf2kx\4m1psgn5fxc.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\8705439','command');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\wsizbbmm3re\gajyrcdbj23.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\8903905','command');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\gszixkjqzeg\c4cpto44yde.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\91H5UBSSOOYGQCT','command');
 DeleteFile('C:\Program Files\NWLJDMXNMW\0LRYLL3OM.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\amigo','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\booster','command');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\PCBooster\booster.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BSHRGE6G4190WT9','command');
 DeleteFile('C:\Program Files\8A6Q2RZFDU\8A6Q2RZFD.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CloudNet','command');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DryRiver','command');
 DeleteFile('C:\Windows\rss\csrss.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\EBFOS9L8IVOEB9D','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\EQUPZHUJENPDLNI','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MediaPlayerApplication','command');
 DeleteFile('C:\Users\ANtiGM\AppData\Roaming\MediaPlayerApplication\MediaPlayerApplication.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Optimizer.exe','command');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Optimizer\Optimizer.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QG8RK72F2UQ0QRQ','command');
 DeleteFile('C:\Program Files (x86)\p1hnblxjgxi\BBBF0.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\systemtools','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TT6R7C7N9A2VJSV','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\YXGIW7K21HCRT5M','command');
 DeleteFile('C:\Program Files\GUGCB9K48G\GUGCB9K48.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Z18L31YD30KR4UW','command');
 DeleteFile('C:\Program Files\AF4JPKEW89\GP5J69GKH.exe','32');
 DeleteFile('C:\Windows\Tasks\bku0512638293085302.job','32');
 DeleteFile('C:\Users\ANtiGM\AppData\Local\Temp\KCJMBzuP7\ytab_m_1_big.exe','32');
 DeleteFile('C:\Windows\Tasks\boQbXxbEJPaDgWztw.job','32');
 DeleteFile('C:\Program Files (x86)\OGqwJxyzdjgEZIvrFER\KBjHMfD.dll','32');
 DeleteFile('C:\Windows\Tasks\jVVcebPoCjhHKmi.job','32');
 DeleteFile('C:\Program Files (x86)\ExRIRmygU\hbvnxD.dll','32');
 DeleteFile('C:\Windows\system32\Tasks\bku0512638293085302','64');
 DeleteFile('C:\Windows\system32\Tasks\BmHhCekqquvtRi','64');
 DeleteFile('C:\Program Files (x86)\vknAtWNPMhpU2\xhGbJvNntxoDj.dll','32');
 DeleteFile('C:\Windows\system32\Tasks\boQbXxbEJPaDgWztw','64');
 DeleteFile('C:\Windows\system32\Tasks\boQbXxbEJPaDgWztw2','64');
 DeleteFile('C:\Windows\system32\Tasks\jVVcebPoCjhHKmi','64');
 DeleteFile('C:\Windows\system32\Tasks\jVVcebPoCjhHKmi2','64');
 DeleteFile('C:\Windows\system32\Tasks\LaCieS','64');
 DeleteFile('C:\Disk\WebService.exe','32');
 DeleteFile('C:\Windows\system32\Tasks\Microsoft\Windows\Launcher','64');
 DeleteFile('C:\Program Files (x86)\Launcher for Windows\winlaunch.exe','32');
 DeleteFile('C:\Windows\system32\Tasks\MKV Player Lite','64');
 DeleteFile('C:\Windows\system32\Tasks\QuickLaunch','64');
 DeleteFile('C:\Windows\system32\Tasks\space(title, t_delayed)','64');
 DeleteFile('C:\Windows\system32\Tasks\space(title, t_monitor)','64');
 DeleteFile('c:\users\antigm\appdata\local\swidfir.dll','32');
 DeleteFile('C:\Windows\windefender.exe','32');
 DeleteFile('C:\Users\ANtiGM\appdata\local\pcbooster\booster.exe','32');
ExecuteSysClean;
ExecuteRepair(2);
ExecuteRepair(3);
ExecuteRepair(4);
ExecuteWizard('TSW',2,3,true);
ExecuteWizard('SCU',2,2,true);
RebootWindows(true);
end.

Компьютер перезагрузится.

4. Сделайте лог утилитой AdwCleaner и пришлите его.

5. Скачайте Farbar Recovery Scan Tool

и сохраните на Рабочем столе.

Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.

Запустите программу двойным щелчком. Когда программа запустится, нажмите Yes для соглашения с предупреждением.
Нажмите кнопку Scan.
После окончания сканирования будет создан отчет (FRST.txt) в той же папке, откуда была запущена программа. Пожалуйста, прикрепите отчет в следующем сообщении.
Если программа была запущена в первый раз, будет создан отчет (Addition.txt). Пожалуйста, прикрепите его в следующем сообщении.

Амиго и прочая хренотень. (заявка № 216696)

Опции темы