Медленно работает виндоус

[aluinna]

Лог во вложении. Спасибо.

[Info_bot]

Уважаемый(ая) aluinna, спасибо за обращение на наш форум!

Удаление вирусов - абсолютно бесплатная услуга на VirusInfo.Info. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитой Autologger, подробнее можно прочитать в правилах оформления запроса о помощи.

Информация

Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом Помогите+.

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

[aluinna]

Все еще жду помощи

[Vvvyg]

Удалите программы (те, которые удалятся штатно):
CiPlus-4.5vV30.07
Content Defender
ContentProtector
Friendly Error
GameXP Точка доступа
globalupdate Helper
HP Defender
Time tasks
Unity Web Player
WordSurfer 1.10.0.19

Выполните скрипт в AVZ:

begin
 TerminateProcessByName('C:\Program Files\ContentProtector\ContentProtector.exe');
 TerminateProcessByName('c:\program files (x86)\rising\rsd\rsmgrsvc.exe');
 StopService('ContentProtector');
 StopService('RsMgrSvc');
 StopService('contentdefenderdrv');
 StopService('ContentProtectorDrv');
 StopService('cssmk');
 QuarantineFileF('c:\program files\contentprotector', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
 QuarantineFileF('c:\programdata\timetasks', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
 QuarantineFileF('c:\users\1\appdata\roaming\newsi_1027\', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
 QuarantineFileF('c:\users\1\appdata\local\systemdir', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
 QuarantineFile('C:\Program Files\ContentProtector\ContentProtector.exe', '');
 QuarantineFile('c:\program files (x86)\rising\rsd\rsmgrsvc.exe', '');
 QuarantineFile('C:\Windows\system32\drivers\contentdefenderdrv.sys', '');
 QuarantineFile('C:\Windows\system32\drivers\ContentProtectorDrv.sys', '');
 QuarantineFile('C:\Program Files (x86)\skinapp\cssmk.sys', '');
 QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.0.16794.227\QMUdisk64.sys', '');
 QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.0.16794.227\TS888x64.sys', '');
 QuarantineFile('C:\Program Files (x86)\Rising\RSD\popwndexe.exe', '');
 QuarantineFile('C:\ProgramData\TimeTasks\timetasks.exe', '');
 QuarantineFile('C:\Users\1\AppData\Roaming\MyDesktop\linkme.exe', '');
 QuarantineFile('C:\Windows\system32\GroupPolicy\Machine\Registry.pol', '');
 QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe', '');
 QuarantineFile('C:\ProgramData\Browsers\browser6.bat', '');
 QuarantineFile('C:\Users\1\AppData\Local\Browsers\browser1.bat', '');
 QuarantineFile('C:\Users\1\AppData\Local\Browsers\browser2.bat', '');
 QuarantineFile('C:\Users\1\AppData\Roaming\Browsers\exe.atemok.bat', '');
 QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV30.07\ae60b39b-ed0e-4287-9f18-d483c42d2363-5.exe', '');
 QuarantineFile('C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe', '');
 QuarantineFile('C:\Program Files (x86)\Shop and Save Up\dd6aa243-1fdd-44b7-b068-2f07cccdd84d-5.exe', '');
 QuarantineFile('C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe', '');
 QuarantineFile('C:\Users\1\AppData\Roaming\newSI_1002\s_inst.exe', '');
 QuarantineFile('C:\Users\1\AppData\Roaming\newSI_1027\s_inst.exe', '');
 QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV30.07\ae60b39b-ed0e-4287-9f18-d483c42d2363-1-6.exe', '');
 QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV30.07\ae60b39b-ed0e-4287-9f18-d483c42d2363-1-7.exe', '');
 QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV30.07\ae60b39b-ed0e-4287-9f18-d483c42d2363-10.exe', '');
 QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV30.07\ae60b39b-ed0e-4287-9f18-d483c42d2363-11.exe', '');
 QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe', '');
 QuarantineFile('C:\Program Files (x86)\Shop and Save Up\dd6aa243-1fdd-44b7-b068-2f07cccdd84d-1-6.exe', '');
 QuarantineFile('C:\Program Files (x86)\Shop and Save Up\dd6aa243-1fdd-44b7-b068-2f07cccdd84d-1-7.exe', '');
 QuarantineFile('C:\Program Files (x86)\Shop and Save Up\dd6aa243-1fdd-44b7-b068-2f07cccdd84d-10.exe', '');
 QuarantineFile('C:\Users\1\AppData\Local\SystemDir\nethost.exe', '');
 QuarantineFile('C:\PROGRAM FILES (X86)\RISING\RAV\rsdelaylauncher.exe', '');
 QuarantineFile('C:\Program Files (x86)\WordSurfer_1.10.0.19\Update\WordSurferAutoUpdateClient.exe', '');
 QuarantineFile('C:\Program Files\content defender\condefsetup.exe', '');
 QuarantineFile('C:\Program Files\content defender\contentdefenderps.dll', '');
 QuarantineFile('C:\Program Files\content defender\import_root_cert.exe', '');
 QuarantineFile('C:\Program Files\content defender\libeay32.dll', '');
 QuarantineFile('C:\Program Files\content defender\nfregdrv.exe', '');
 QuarantineFile('C:\Program Files\content defender\nss\certutil.exe', '');
 QuarantineFile('C:\Program Files\content defender\nss\mozcrt19.dll', '');
 QuarantineFile('C:\Program Files\content defender\nss\nspr4.dll', '');
 QuarantineFile('C:\Program Files\content defender\nss\nss3.dll', '');
 QuarantineFile('C:\Program Files\content defender\nss\plc4.dll', '');
 QuarantineFile('C:\Program Files\content defender\nss\plds4.dll', '');
 QuarantineFile('C:\Program Files\content defender\nss\smime3.dll', '');
 QuarantineFile('C:\Program Files\content defender\nss\softokn3.dll', '');
 QuarantineFile('C:\Program Files\content defender\ssleay32.dll', '');
 QuarantineFile('C:\Program Files\contentprotector\condefclean.exe', '');
 QuarantineFile('C:\Program Files\contentprotector\conprotsetup.exe', '');
 QuarantineFile('C:\Program Files\contentprotector\contentprotectorconrol.exe', '');
 QuarantineFile('C:\Program Files\contentprotector\contentprotectordrv.sys', '');
 QuarantineFile('C:\Program Files\contentprotector\import_root_cert.exe', '');
 QuarantineFile('C:\Program Files\contentprotector\libeay32.dll', '');
 QuarantineFile('C:\Program Files\contentprotector\nss\certutil.exe', '');
 QuarantineFile('C:\Program Files\contentprotector\nss\mozcrt19.dll', '');
 QuarantineFile('C:\Program Files\contentprotector\nss\nspr4.dll', '');
 QuarantineFile('C:\Program Files\contentprotector\nss\nss3.dll', '');
 QuarantineFile('C:\Program Files\contentprotector\nss\plc4.dll', '');
 QuarantineFile('C:\Program Files\contentprotector\nss\plds4.dll', '');
 QuarantineFile('C:\Program Files\contentprotector\nss\smime3.dll', '');
 QuarantineFile('C:\Program Files\contentprotector\nss\softokn3.dll', '');
 QuarantineFile('C:\Program Files\contentprotector\ssleay32.dll', '');
 DeleteFile('C:\Windows\Tasks\ae60b39b-ed0e-4287-9f18-d483c42d2363-5_user.job', '64');
 DeleteFile('C:\Windows\Tasks\APSnotifierPP2.job', '64');
 DeleteFile('C:\Windows\Tasks\APSnotifierPP3.job', '64');
 DeleteFile('C:\Windows\Tasks\dd6aa243-1fdd-44b7-b068-2f07cccdd84d-5_user.job', '64');
 DeleteFile('C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job', '64');
 DeleteFile('C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job', '64');
 DeleteFile('C:\Windows\Tasks\newSI_1002.job', '64');
 DeleteFile('C:\Windows\Tasks\newSI_1027.job', '64');
 DeleteFile('C:\Program Files\ContentProtector\ContentProtector.exe', '32');
 DeleteFile('c:\program files (x86)\rising\rsd\rsmgrsvc.exe', '32');
 DeleteFile('C:\Windows\system32\drivers\contentdefenderdrv.sys', '32');
 DeleteFile('C:\Windows\system32\drivers\ContentProtectorDrv.sys', '32');
 DeleteFile('C:\Program Files (x86)\skinapp\cssmk.sys', '32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.0.16794.227\QMUdisk64.sys', '32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.0.16794.227\TS888x64.sys', '32');
 DeleteFile('C:\Program Files (x86)\Rising\RSD\popwndexe.exe', '32');
 DeleteFile('C:\ProgramData\TimeTasks\timetasks.exe', '32');
 DeleteFile('C:\Users\1\AppData\Roaming\MyDesktop\linkme.exe', '32');
 DeleteFile('C:\Windows\system32\GroupPolicy\Machine\Registry.pol', '32');
 DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe', '32');
 DeleteFile('C:\ProgramData\Browsers\browser6.bat', '32');
 DeleteFile('C:\Users\1\AppData\Local\Browsers\browser1.bat', '32');
 DeleteFile('C:\Users\1\AppData\Local\Browsers\browser2.bat', '32');
 DeleteFile('C:\Users\1\AppData\Roaming\Browsers\exe.atemok.bat', '32');
 DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV30.07\ae60b39b-ed0e-4287-9f18-d483c42d2363-5.exe', '32');
 DeleteFile('C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe', '32');
 DeleteFile('C:\Program Files (x86)\Shop and Save Up\dd6aa243-1fdd-44b7-b068-2f07cccdd84d-5.exe', '32');
 DeleteFile('C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe', '32');
 DeleteFile('C:\Users\1\AppData\Roaming\newSI_1002\s_inst.exe', '32');
 DeleteFile('C:\Users\1\AppData\Roaming\newSI_1027\s_inst.exe', '32');
 DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV30.07\ae60b39b-ed0e-4287-9f18-d483c42d2363-1-6.exe', '32');
 DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV30.07\ae60b39b-ed0e-4287-9f18-d483c42d2363-1-7.exe', '32');
 DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV30.07\ae60b39b-ed0e-4287-9f18-d483c42d2363-10.exe', '32');
 DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV30.07\ae60b39b-ed0e-4287-9f18-d483c42d2363-11.exe', '32');
 DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe', '32');
 DeleteFile('C:\Program Files (x86)\Shop and Save Up\dd6aa243-1fdd-44b7-b068-2f07cccdd84d-1-6.exe', '32');
 DeleteFile('C:\Program Files (x86)\Shop and Save Up\dd6aa243-1fdd-44b7-b068-2f07cccdd84d-1-7.exe', '32');
 DeleteFile('C:\Program Files (x86)\Shop and Save Up\dd6aa243-1fdd-44b7-b068-2f07cccdd84d-10.exe', '32');
 DeleteFile('C:\Users\1\AppData\Local\SystemDir\nethost.exe', '32');
 DeleteFile('C:\PROGRAM FILES (X86)\RISING\RAV\rsdelaylauncher.exe', '32');
 DeleteFile('C:\Program Files (x86)\WordSurfer_1.10.0.19\Update\WordSurferAutoUpdateClient.exe', '32');
 DeleteFile('C:\Program Files\content defender\condefsetup.exe', '32');
 DeleteFile('C:\Program Files\content defender\contentdefenderps.dll', '32');
 DeleteFile('C:\Program Files\content defender\import_root_cert.exe', '32');
 DeleteFile('C:\Program Files\content defender\libeay32.dll', '32');
 DeleteFile('C:\Program Files\content defender\nfregdrv.exe', '32');
 DeleteFile('C:\Program Files\content defender\nss\certutil.exe', '32');
 DeleteFile('C:\Program Files\content defender\nss\mozcrt19.dll', '32');
 DeleteFile('C:\Program Files\content defender\nss\nspr4.dll', '32');
 DeleteFile('C:\Program Files\content defender\nss\nss3.dll', '32');
 DeleteFile('C:\Program Files\content defender\nss\plc4.dll', '32');
 DeleteFile('C:\Program Files\content defender\nss\plds4.dll', '32');
 DeleteFile('C:\Program Files\content defender\nss\smime3.dll', '32');
 DeleteFile('C:\Program Files\content defender\nss\softokn3.dll', '32');
 DeleteFile('C:\Program Files\content defender\ssleay32.dll', '32');
 DeleteFile('C:\Program Files\contentprotector\condefclean.exe', '32');
 DeleteFile('C:\Program Files\contentprotector\conprotsetup.exe', '32');
 DeleteFile('C:\Program Files\contentprotector\contentprotectorconrol.exe', '32');
 DeleteFile('C:\Program Files\contentprotector\contentprotectordrv.sys', '32');
 DeleteFile('C:\Program Files\contentprotector\import_root_cert.exe', '32');
 DeleteFile('C:\Program Files\contentprotector\libeay32.dll', '32');
 DeleteFile('C:\Program Files\contentprotector\nss\certutil.exe', '32');
 DeleteFile('C:\Program Files\contentprotector\nss\mozcrt19.dll', '32');
 DeleteFile('C:\Program Files\contentprotector\nss\nspr4.dll', '32');
 DeleteFile('C:\Program Files\contentprotector\nss\nss3.dll', '32');
 DeleteFile('C:\Program Files\contentprotector\nss\plc4.dll', '32');
 DeleteFile('C:\Program Files\contentprotector\nss\plds4.dll', '32');
 DeleteFile('C:\Program Files\contentprotector\nss\smime3.dll', '32');
 DeleteFile('C:\Program Files\contentprotector\nss\softokn3.dll', '32');
 DeleteFile('C:\Program Files\contentprotector\ssleay32.dll', '32');
 DeleteFile('wsasvc_1.10.0.19', '32');
 DeleteService('ContentProtector');
 DeleteService('RsMgrSvc');
 DeleteService('contentdefenderdrv');
 DeleteService('ContentProtectorDrv');
 DeleteService('cssmk');
 DeleteService('QMUdisk');
 DeleteService('TS888x64');
 DeleteFileMask('c:\program files\contentprotector', '*', true);
 DeleteFileMask('c:\program files (x86)\rising', '*', true);
 DeleteFileMask('c:\program files (x86)\skinapp', '*', true);
 DeleteFileMask('c:\program files (x86)\tencent', '*', true);
 DeleteFileMask('c:\programdata\timetasks', '*', true);
 DeleteFileMask('c:\users\1\appdata\roaming\mydesktop', '*', true);
 DeleteFileMask('c:\program files (x86)\crossbrowse', '*', true);
 DeleteFileMask('c:\program files (x86)\ciplus-4.5vv30.07', '*', true);
 DeleteFileMask('c:\program files (x86)\anyprotectex', '*', true);
 DeleteFileMask('c:\program files (x86)\shop and save up', '*', true);
 DeleteFileMask('c:\program files (x86)\globalupdate', '*', true);
 DeleteFileMask('c:\users\1\appdata\roaming\newsi_1002', '*', true);
 DeleteFileMask('c:\users\1\appdata\roaming\newsi_1027\', '*', true);
 DeleteFileMask('c:\users\1\appdata\local\systemdir', '*', true);
 DeleteFileMask('c:\program files (x86)\wordsurfer_1.10.0.19', '*', true);
 DeleteFileMask('c:\program files\content defender', '*', true);
 DeleteDirectory('c:\program files\contentprotector');
 DeleteDirectory('c:\program files (x86)\rising');
 DeleteDirectory('c:\program files (x86)\skinapp');
 DeleteDirectory('c:\program files (x86)\tencent');
 DeleteDirectory('c:\programdata\timetasks');
 DeleteDirectory('c:\users\1\appdata\roaming\mydesktop');
 DeleteDirectory('c:\program files (x86)\crossbrowse');
 DeleteDirectory('c:\program files (x86)\ciplus-4.5vv30.07');
 DeleteDirectory('c:\program files (x86)\anyprotectex');
 DeleteDirectory('c:\program files (x86)\shop and save up');
 DeleteDirectory('c:\program files (x86)\globalupdate');
 DeleteDirectory('c:\users\1\appdata\roaming\newsi_1002');
 DeleteDirectory('c:\users\1\appdata\roaming\newsi_1027\');
 DeleteDirectory('c:\users\1\appdata\local\systemdir');
 DeleteDirectory('c:\program files (x86)\wordsurfer_1.10.0.19');
 DeleteDirectory('c:\program files\content defender');
 ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "ae60b39b-ed0e-4287-9f18-d483c42d2363-1-6" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "ae60b39b-ed0e-4287-9f18-d483c42d2363-1-7" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "ae60b39b-ed0e-4287-9f18-d483c42d2363-10_user" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "ae60b39b-ed0e-4287-9f18-d483c42d2363-11" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "ae60b39b-ed0e-4287-9f18-d483c42d2363-5" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "ae60b39b-ed0e-4287-9f18-d483c42d2363-5_user" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP1" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP2" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP3" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "Crossbrowse" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "dd6aa243-1fdd-44b7-b068-2f07cccdd84d-1-6" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "dd6aa243-1fdd-44b7-b068-2f07cccdd84d-1-7" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "dd6aa243-1fdd-44b7-b068-2f07cccdd84d-10_user" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "dd6aa243-1fdd-44b7-b068-2f07cccdd84d-5_user" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "globalUpdateUpdateTaskMachineCore" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "globalUpdateUpdateTaskMachineUA" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "nethost task" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "newSI_1002" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "newSI_1027" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "RsDelayLauncher_{8A34248E-7D35-4832-8378-7659E0B0A380}" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "WordSurfer Auto Updater 1.10.0.19 Core" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "WordSurfer Auto Updater 1.10.0.19 Pending Update" /F', 0, 15000, true);
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'RSDTRAY');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'Timestasks');
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'MyDesktop');
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'C');
 CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
ExecuteSysClean;
 ExecuteWizard('SCU', 2, 2, true);
RebootWindows(true);
end.

Компьютер перезагрузится.

В папке с AVZ появится архив карантина quarantine.zip, отправьте этот файл по ссылке "Прислать запрошенный карантин" над над первым сообщением в теме.

Перетащите лог Check_Browsers_LNK.log из папки Autologger на утилиту ClearLNK. Отчёт о работе прикрепите.

Сделайте новый лог Autologger.

Сделайте лог Malwarebytes AdwCleaner.