Помогите вылечить. [not-a-virus:AdWare.Win32.ELEX.bhd, not-a-virus:AdWare.Win32.Agent.jleq ]

[varyagius]

Здравствуйте. Помогите пожалуйста вылечить компьютер. Появилось китайское ПО и браузер открывается самостоятельно и выскакивает реклама.

[Info_bot]

Уважаемый(ая) varyagius, спасибо за обращение на наш форум!

Помощь в лечении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитой Autologger, подробнее можно прочитать в правилах оформления запроса о помощи.

Информация

Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом Помогите+.

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

[thyrex]

Выполните скрипт в AVZ

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 QuarantineFile('C:\Users\Admin\appdata\roaming\mydesktop\linkme.exe','');
 QuarantineFile('C:\Users\Admin\appdata\roaming\event monitor\isxdl.dll','');
 QuarantineFile('C:\Users\Admin\appdata\roaming\event monitor\em.exe','');
 QuarantineFile('C:\Users\Admin\appdata\roaming\adobe\manager.exe','');
 QuarantineFile('C:\Users\Admin\AppData\Roaming\Adobe\Manager.exe','');
 QuarantineFile('C:\ProgramData\RegisterObject\RegisterObject.exe','');
 QuarantineFile('C:\Program Files (x86)\Coicit Schedule\local64spl.dll','');
 QuarantineFile('C:\Users\Admin\AppData\Roaming\WinSAPSvc\WinSAP.dll','');
 QuarantineFile('C:\Users\Admin\AppData\Local\SNARER\Snarer.dll','');
 QuarantineFile('C:\Users\Admin\AppData\Local\SNARE\Snarer.dll','');
 QuarantineFile('C:\ProgramData\Software\Apple\Apps\Notification.dll','');
 SetServiceStart('QMUdisk', 4);
 SetServiceStart('QQSysMonX64', 4);
 SetServiceStart('softaal', 4);
 SetServiceStart('TAOAccelerator', 4);
 SetServiceStart('TAOKernelDriver', 4);
 SetServiceStart('TFsFlt', 4);
 SetServiceStart('tsnethlpx64', 4);
 SetServiceStart('TSSysKit', 4);
 DeleteService('iiozfcqz');
 DeleteService('TSSysKit');
 DeleteService('tsnethlpx64');
 DeleteService('TFsFlt');
 DeleteService('TAOKernelDriver');
 DeleteService('TAOAccelerator');
 DeleteService('softaal');
 DeleteService('QQSysMonX64');
 DeleteService('QMUdisk');
 SetServiceStart('Kitty', 4);
 SetServiceStart('QQPCRTP', 4);
 SetServiceStart('Recover', 4);
 DeleteService('iSafeService');
 DeleteService('Recover');
 DeleteService('QQPCRTP');
 DeleteService('Kitty');
 QuarantineFile('c:\users\admin\appdata\roaming\winsapsvc\winsap.dll','');
 QuarantineFile('C:\Program Files (x86)\Alltie\Application\chrome_child.dll','');
 QuarantineFile('C:\Program Files (x86)\Alltie\Application\chrome.dll','');
 TerminateProcessByName('C:\Program Files\Microsoft Office\8LR5SU4SQIIT2\n6oz1CGZCx.exe');
 QuarantineFile('C:\Program Files\Microsoft Office\8LR5SU4SQIIT2\n6oz1CGZCx.exe','');
 TerminateProcessByName('c:\program files (x86)\tencent\qqpcmgr\11.8.17919.214\qqpcrtp.exe');
 TerminateProcessByName('C:\Users\Admin\AppData\Roaming\gplyra\gplyra.exe');
 QuarantineFile('C:\Users\Admin\AppData\Roaming\gplyra\gplyra.exe','');
 TerminateProcessByName('c:\users\admin\appdata\local\kitty\cat.exe');
 QuarantineFile('c:\users\admin\appdata\local\kitty\cat.exe','');
 DeleteFile('c:\users\admin\appdata\local\kitty\cat.exe','32');
 DeleteFile('C:\Users\Admin\AppData\Roaming\gplyra\gplyra.exe','32');
 DeleteFile('c:\program files (x86)\tencent\qqpcmgr\11.8.17919.214\qqpcrtp.exe','32');
 DeleteFile('C:\Program Files\Microsoft Office\8LR5SU4SQIIT2\n6oz1CGZCx.exe','32');
 DeleteFile('C:\Program Files (x86)\Alltie\Application\chrome.dll','32');
 DeleteFile('C:\Program Files (x86)\Alltie\Application\chrome_child.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\communic.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\dr.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\plugins\QMBDScanner.dat','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\plugins\QMCloudInter\QMCloudInter.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\plugins\QMHipsEngine.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\plugins\qmiemalrtpplugin\qmiemalrtpplugin.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\plugins\QMRepairPlugin.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\plugins\sysspeeduprtpplugin\SysSpeedupRtpPlugin.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\ptrate.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMAntiInject.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMAssocScan.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMAVProxy.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMCommon.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMDns.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMEmMat.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMExt.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMFileMon.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMHIPSHeart.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMHIPSPolicyEng.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMHIPSService.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMInfoEng.DLL','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMIpc.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMNetworkMgr.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMRtpCheck.dll','32');
 DeleteFile('c:\program files (x86)\tencent\qqpcmgr\11.8.17919.214\qmrtpcontroller.dll','32');
 DeleteFile('c:\users\admin\appdata\roaming\winsapsvc\winsap.dll','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMUdisk64.sys','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQSysMonX64.sys','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\softaal64.sys','32');
 DeleteFile('C:\WINDOWS\system32\Drivers\TAOAccelerator64.sys','32');
 DeleteFile('C:\WINDOWS\system32\Drivers\TAOKernelEx64.sys','32');
 DeleteFile('C:\WINDOWS\system32\Drivers\TFsFltX64.sys','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\TsNetHlpX64.sys','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\TSSysKit64.sys','32');
 DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe','32');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCTray.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','QQPCTray');
 DeleteFile('C:\Users\Admin\AppData\Local\SNARE\Snarer.dll','32');
 DeleteFile('C:\Users\Admin\AppData\Local\SNARER\Snarer.dll','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\SNARE\Parameters','ServiceDll');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\SNARER\Parameters','ServiceDll');
 DeleteFile('C:\Users\Admin\AppData\Roaming\WinSAPSvc\WinSAP.dll','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\WinSAPSvc\Parameters','ServiceDll');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','gplyra');
 DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMContextScan.dll','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved','{63332668-8CE1-445D-A5EE-25929176714E}');
 DeleteFile('C:\Program Files (x86)\Coicit Schedule\local64spl.dll','32');
 DeleteFile('C:\ProgramData\RegisterObject\RegisterObject.exe','32');
 DeleteFile('C:\Users\Admin\AppData\Roaming\Adobe\Manager.exe','32');
 DeleteFile('C:\WINDOWS\system32\Tasks\Microsoft\Windows\Multimedia\Manager','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\Microsoft\Windows\Media Center\RegisterObject','64');
 DeleteFile('C:\Users\Admin\appdata\roaming\adobe\manager.exe','32');
 DeleteFile('C:\Users\Admin\appdata\roaming\event monitor\em.exe','32');
 DeleteFile('C:\Users\Admin\appdata\roaming\event monitor\isxdl.dll','32');
 DeleteFile('C:\Users\Admin\appdata\roaming\mydesktop\linkme.exe','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

Будет выполнена перезагрузка компьютера.

Выполните скрипт в AVZ

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

c:\quarantine.zip пришлите по красной ссылке Прислать запрошенный карантин над первым сообщением темы.

Пожалуйста, выполните ЕЩЕ РАЗ правила, прикрепите к сообщению НОВЫЕ логи Autologger

[varyagius]

Готово

- - - - -Добавлено - - - - -

Вложение 658867

[thyrex]

Скачайте Farbar Recovery Scan Tool и сохраните на Рабочем столе.

• Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.

1. Запустите программу двойным щелчком. Когда программа запустится, нажмите Yes для соглашения с предупреждением.
2. Убедитесь, что в окне Optional Scan отмечены List BCD, Driver MD5 и 90 Days Files.

3. Нажмите кнопку Scan.
4. После окончания сканирования будет создан отчет (FRST.txt) в той же папке, откуда была запущена программа.
5. Если программа была запущена в первый раз, также будет создан отчет (Addition.txt).
6. Отчеты, полученные в пп. 4 и 5, заархивируйте (в один архив) и прикрепите к сообщению.

[varyagius]

Архив

[thyrex]

1. Откройте Блокнот и скопируйте в него приведенный ниже текст

CreateRestorePoint:
HKLM-x32\...\Run: [ QQPCTray] => C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCTRAY.EXE [364776 2017-04-17] (Tencent)
HKU\S-1-5-18\...\Run: [] => [X]
HKLM\...\Providers\t9fbuo4e: C:\Program Files (x86)\Coicit Schedule\local64spl.dll
ShellExecuteHooks: No Name - {9ECA4088-12F7-11E7-99D3-64006A5CFC23} - C:\Users\Admin\AppData\Roaming\Wtedomstgule\Qzuyquzsp.dll -> No File
ShellExecuteHooks: No Name - {F580A390-1B48-11E7-9343-64006A5CFC23} - C:\Users\Admin\AppData\Roaming\Devolyreozot\Ferray.dll -> No File
ShellExecuteHooks: No Name - {0A767F30-1B4A-11E7-9EAE-64006A5CFC23} - C:\Users\Admin\AppData\Roaming\Rersertainthigert\Goceshlooward.dll -> No File
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMGCShellExt64.dll [2017-04-17] (Tencent)
GroupPolicy: Restriction - Chrome <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ourluckysites.com/?type=hp&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.6789.com/?id=107
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.ourluckysites.com/search/?type=ds&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.ourluckysites.com/search/?type=ds&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ourluckysites.com/?type=hp&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ourluckysites.com/?type=hp&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2&q={searchTerms}
HKU\S-1-5-21-2333222683-866717645-1682636863-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.6789.com/?id=107
HKU\S-1-5-21-2333222683-866717645-1682636863-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ourluckysites.com/?type=hp&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2333222683-866717645-1682636863-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2&q={searchTerms}
BHO: 电脑管家网页防火墙 -> {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} -> C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\TSWebMon64.dat [2017-04-17] (Tencent)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.ourluckysites.com/?type=sc&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2
Edge HomeButtonPage: HKU\S-1-5-21-2333222683-866717645-1682636863-1001 -> hxxp://www.ourluckysites.com/?type=hp&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2
FF NewTab: Mozilla\Firefox\Profiles\rqeabucp.default -> hxxp://www.initialpage123.com/?z=3ba98ebc94f193f02e759d9g7z3tco9eagfwaz5c3c&from=bcn&uid=KINGSTONXSUV400S37120G_50026B776A0689A2&type=hp
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\rqeabucp.default -> initialpage123
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\rqeabucp.default -> initialpage123
FF Extension: (The Safe Surfing) - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rqeabucp.default\Extensions\{3B4DE07A-DE43-4DBC-873F-05835FF67DCE} [2017-04-19] [not signed]
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rqeabucp.default\searchplugins\3nhzdb4t.xml [2017-04-12]
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rqeabucp.default\searchplugins\igt9hqh9.xml [2017-04-12]
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rqeabucp.default\searchplugins\t9fbuo4e.xml [2017-04-02]
FF NewTab: Firefox\Firefox\Profiles\rqeabucp.default -> hxxp://www.initialpage123.com/?z=3ba98ebc94f193f02e759d9g7z3tco9eagfwaz5c3c&from=bcn&uid=KINGSTONXSUV400S37120G_50026B776A0689A2&type=hp
FF SelectedSearchEngine: Firefox\Firefox\Profiles\rqeabucp.default -> initialpage123
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Firefox\Firefox\Profiles\rqeabucp.default\searchplugins\3nhzdb4t.xml [2017-04-12]
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Firefox\Firefox\Profiles\rqeabucp.default\searchplugins\igt9hqh9.xml [2017-04-12]
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Firefox\Firefox\Profiles\rqeabucp.default\searchplugins\startsearch.xml [2017-04-15]
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Firefox\Firefox\Profiles\rqeabucp.default\searchplugins\t9fbuo4e.xml [2017-04-02]
FF Plugin-x32: @qq.com/QQPCMgr -> C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\npQMExtensionsMozilla.dll [2017-04-17] (Tencent Technology (Shenzhen) Company Limited)
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.ourluckysites.com/?type=sc&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2
CHR StartupUrls: ChromeDefaultData2 -> "hxxp://www.initialpage123.com/?z=3ba98ebc94f193f02e759d9g7z3tco9eagfwaz5c3c&from=bcn&uid=KINGSTONXSUV400S37120G_50026B776A0689A2&type=hp"
CHR Extension: (SearchWay) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\achhckalphdlhbnohjonneffefbmaddi [2017-04-01]
CHR Extension: (Ultimate Discounter) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\ckcmdpmhiekiihmfjffdehhbhgllpapg [2017-04-17]
CHR Extension: (The Safe Surfing) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\kcknbenjnkkjknphmnidanjifbgphjke [2017-04-19]
CHR Extension: (BestSalesProfit) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\nfifbepiadlffiooandnambiojdgccdo [2017-04-01]
CHR HKLM-x32\...\Chrome\Extension: [bkojblfdgdpmhcbkagoinfkkkadlokeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ccfifbojenkenpkmnbnndeadpfdiffof] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fpbfphainfaannpfnfnhbibojpaphkgd] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [oelpkepjlgmehajehfeicfbjdiobdkfj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [oilhebpjhnjaeghedpjnmajajlcfdjgc] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ojlcebdkbpjdpiligkdbbkdkfjmchbfd] - hxxps://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.ourluckysites.com/?type=sc&ts=1492418874&z=44cd590eac718b37685ea19g9z2t2o1zagbb2bdm7w&from=che0812&uid=KINGSTONXSUV400S37120G_50026B776A0689A2
HKU\S-1-5-21-2333222683-866717645-1682636863-1001\...\StartMenuInternet\ChromeHTML: -> C:\Program Files (x86)\Alltie\Application\chrome.exe (Google Inc.) <==== ATTENTION
OPR Extension: (The Safe Surfing) - C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\kcknbenjnkkjknphmnidanjifbgphjke [2017-04-19]
R2 QQPCRTP; C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCRTP.exe [315920 2017-04-17] (Tencent)
S2 SNARE; C:\Windows\System32\svchost.exe [44496 2016-07-16] (Microsoft Corporation)
S2 SNARE; C:\Windows\SysWOW64\svchost.exe [38792 2016-07-16] (Microsoft Corporation)
S2 SNARER; C:\Windows\System32\svchost.exe [44496 2016-07-16] (Microsoft Corporation)
S2 SNARER; C:\Windows\SysWOW64\svchost.exe [38792 2016-07-16] (Microsoft Corporation)
R2 WinSAPSvc; C:\Users\Admin\AppData\Roaming\WinSAPSvc\WinSAP.dll [568320 2017-04-21] (winsap) [File not signed]
R1 QMUdisk; C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMUdisk64_ev.sys [206568 2017-04-11] (Tencent)
R2 QQSysMonX64; C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQSysMonX64.sys [152568 2016-08-29] (电脑管家)
R1 softaal; C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\softaal64.sys [42488 2017-04-17] (Tencent)
R3 TAOAccelerator; C:\WINDOWS\system32\Drivers\TAOAccelerator64.sys [97880 2017-04-17] (Tencent)
R2 TAOKernelDriver; C:\WINDOWS\system32\Drivers\TAOKernelEx64.sys [141816 2017-04-17] (Tencent Technology(Shenzhen) Company Limited)
R3 TcHardWare; C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCHW-x64.sys [16552 2017-04-17] (Tencent)
R3 TFsFlt; C:\WINDOWS\System32\Drivers\TFsFltX64.sys [95224 2017-04-17] (电脑管家)
S1 TSDefenseBt; C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\TSDefenseBT64.sys [28984 2017-04-17] (Tencent)
R4 TSSysKit; C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\TSSysKit64.sys [94712 2017-04-17] (电脑管家)
S2 tsnethlpx64; \??\C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\TsNetHlpX64_ev.sys [X]
2017-04-19 21:49 - 2017-04-19 21:49 - 00000000 ____D C:\Users\Admin\AppData\Local\Kometa
2017-04-19 21:49 - 2017-04-19 21:49 - 00000000 ____D C:\Users\Admin\AppData\Local\Crossbrowse
2017-04-17 22:16 - 2017-04-17 22:16 - 00000000 ____D C:\QMDownload
2017-04-17 22:02 - 2017-04-19 21:49 - 00000000 ____D C:\Users\Все пользователи\TXQMPC
2017-04-17 22:02 - 2017-04-19 21:49 - 00000000 ____D C:\ProgramData\TXQMPC
2017-04-17 22:02 - 2017-04-17 22:02 - 00000000 ____D C:\Program Files\Common Files\Tencent
2017-04-17 22:02 - 2017-04-17 21:59 - 00141816 _____ (Tencent Technology(Shenzhen) Company Limited) C:\WINDOWS\system32\Drivers\TAOKernelEx64.sys
2017-04-17 22:02 - 2017-04-17 21:59 - 00097880 _____ (Tencent) C:\WINDOWS\system32\Drivers\TAOAccelerator64.sys
2017-04-17 22:01 - 2017-04-17 21:59 - 00095224 _____ (电脑管家) C:\WINDOWS\system32\Drivers\TFsFltX64.sys
2017-04-17 21:58 - 2017-04-17 21:58 - 00000000 ____D C:\Program Files (x86)\Tencent
2017-04-17 21:57 - 2017-04-21 22:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Tencent
2017-04-17 21:57 - 2017-04-17 22:35 - 00000000 ____D C:\Users\Все пользователи\Tencent
2017-04-17 21:57 - 2017-04-17 22:35 - 00000000 ____D C:\ProgramData\Tencent
2017-04-17 11:47 - 2017-04-21 21:22 - 00000000 ____D C:\Users\Admin\AppData\Local\SNARE
2017-04-15 15:05 - 2017-04-21 22:16 - 00000000 ____D C:\Program Files (x86)\Elex-tech
2017-04-15 15:05 - 2017-04-18 19:23 - 00000000 ____D C:\Users\Admin\AppData\Local\Kitty
2017-04-15 15:05 - 2017-04-17 21:43 - 00000000 _____ C:\Users\Public\Documents\report.dat
2017-04-15 15:05 - 2017-04-15 15:05 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Elex-tech
2017-04-15 14:27 - 2017-04-17 21:41 - 00062464 _____ () C:\Theobald.dll
2017-04-14 23:49 - 2017-04-14 23:49 - 00000000 ____D C:\Users\Admin\.zaxargamesteam
2017-04-14 23:49 - 2017-04-14 23:49 - 00000000 ____D C:\Users\Admin\.ZaxarGameBrowser
2017-04-12 19:43 - 2017-04-12 19:43 - 00000000 ____D C:\Program Files (x86)\Mjeward
2017-04-12 19:43 - 2017-04-12 19:43 - 00000000 ____D C:\Program Files (x86)\Ghocacultreererle Renew
2017-04-12 19:40 - 2017-04-12 19:44 - 00000000 ____D C:\Users\Admin\AppData\Local\Ghuitainshgesh
2017-04-12 19:37 - 2017-04-12 19:37 - 00000000 ____D C:\Program Files\8LLAQIRRUB
2017-04-12 19:33 - 2017-04-21 21:21 - 00000000 ____D C:\Users\Admin\AppData\Roaming\gplyra
2017-04-12 19:33 - 2017-04-12 19:55 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Devolyreozot
2017-04-12 19:33 - 2017-04-12 19:34 - 00000000 ____D C:\Users\Admin\AppData\Local\Caguied
2017-04-12 19:33 - 2017-04-12 19:33 - 00000000 ____D C:\Program Files\NIATA7O52B
2017-04-12 19:33 - 2017-04-12 19:33 - 00000000 ____D C:\Program Files (x86)\Qamagevicasy Manager
2017-04-12 19:33 - 2017-04-12 19:33 - 00000000 ____D C:\Program Files (x86)\Hojigh
2017-04-12 19:32 - 2017-04-12 19:48 - 00000000 ____D C:\Program Files (x86)\DiskP
2017-04-12 19:32 - 2017-04-12 19:45 - 00000000 ____D C:\Users\Admin\AppData\Roaming\72538144
2017-04-12 19:32 - 2017-04-12 19:32 - 00000000 ____D C:\Program Files\TS569GO8EW
2017-04-12 19:32 - 2017-04-12 19:32 - 00000000 ____D C:\Program Files\GOKSUVURH1
2017-04-12 19:32 - 2017-04-12 19:32 - 00000000 ____D C:\Program Files\DIHLX5BYEI
2017-04-10 08:54 - 2017-04-21 21:22 - 00000000 ____D C:\Users\Admin\AppData\Local\SNARER
2017-04-10 08:49 - 2017-04-10 08:49 - 00000000 ____D C:\Program Files (x86)\t9fbuo4e
2017-04-09 12:58 - 2017-04-14 23:49 - 00000000 ____D C:\Users\Admin\AppData\Local\ZaxarGameBrowser
2017-04-07 20:14 - 2017-04-21 21:25 - 00000000 ____D C:\Users\Admin\AppData\Roaming\WinSAPSvc
2017-04-07 20:14 - 2017-04-12 19:45 - 00000000 ____D C:\Users\Admin\AppData\Local\AMD
2017-04-07 20:14 - 2017-04-07 20:14 - 00000000 ____D C:\Users\Admin\AppData\Roaming\SNARER
2017-04-07 20:14 - 2017-04-07 20:14 - 00000000 ____D C:\Update
2017-04-07 20:14 - 2017-04-07 20:14 - 00000000 ____D C:\Program Files (x86)\MIO
2017-04-04 21:52 - 2017-04-21 21:21 - 00000000 ____D C:\Users\Admin\AppData\Roaming\MyDesktop
2017-04-04 21:51 - 2017-04-17 21:43 - 00140288 _____ C:\Users\Admin\AppData\Roaming\Installer.dat
2017-04-04 21:51 - 2017-04-17 21:43 - 00011568 _____ C:\Users\Admin\AppData\Roaming\InstallationConfiguration.xml
2017-04-02 16:59 - 2017-04-02 16:59 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Note-UP
2017-04-02 16:49 - 2017-04-21 21:22 - 00000000 ____D C:\Program Files (x86)\Coicit Schedule
2017-04-02 16:49 - 2017-04-12 19:25 - 00000000 ____D C:\Program Files (x86)\Ckeckphicght
2017-04-02 16:49 - 2017-04-04 22:07 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Wtedomstgule
2017-04-02 16:49 - 2017-04-02 16:50 - 00000000 ____D C:\Users\Admin\AppData\Local\Atiqry
2017-04-01 16:47 - 2017-04-21 21:21 - 00000000 ____D C:\Users\Все пользователи\RegisterObject
2017-04-01 16:47 - 2017-04-21 21:21 - 00000000 ____D C:\ProgramData\RegisterObject
2017-04-01 16:47 - 2017-04-17 22:35 - 00000000 ____D C:\Program Files\My Web Shield
2017-04-01 16:49 - 2017-04-02 00:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Amigo
2017-04-01 16:47 - 2017-04-04 21:48 - 00000000 ____D C:\Program Files (x86)\Ultimate-Discounter Browser
2017-04-17 21:49 - 2017-04-17 21:50 - 0323584 _____ () C:\Users\Admin\AppData\Local\Temp\ApphelperV9.exe
2017-04-21 22:06 - 2017-04-21 22:06 - 0000000 _____ () C:\Users\Admin\AppData\Local\Temp\condefclean.exe
2017-04-12 19:43 - 2017-04-17 21:48 - 0060637 _____ () C:\Users\Admin\AppData\Local\Temp\ContentPushSetup.exe
2016-12-23 14:19 - 2016-12-23 14:19 - 0187240 _____ () C:\Users\Admin\AppData\Local\Temp\downloader.exe
2017-04-02 16:47 - 2017-04-02 16:48 - 2042425 _____ (                                                            ) C:\Users\Admin\AppData\Local\Temp\e4e21d18-17aa-11e7-9612-689423849280.exe
2017-04-01 16:47 - 2017-04-01 16:47 - 3249988 _____ () C:\Users\Admin\AppData\Local\Temp\enxcript.exe
2017-04-12 19:32 - 2017-04-12 19:32 - 0383550 _____ (                                                            ) C:\Users\Admin\AppData\Local\Temp\global_installer.exe
2017-04-01 16:46 - 2017-04-01 16:47 - 3039448 _____ () C:\Users\Admin\AppData\Local\Temp\hcv_mailruhomesearch (1).exe
2017-04-01 16:47 - 2017-04-01 16:47 - 3039448 _____ () C:\Users\Admin\AppData\Local\Temp\hcv_mailruhomesearch (2).exe
2017-04-01 16:46 - 2017-04-01 16:46 - 3039448 _____ () C:\Users\Admin\AppData\Local\Temp\hcv_mailruhomesearch.exe
2017-04-01 16:47 - 2017-04-01 16:48 - 3039448 _____ () C:\Users\Admin\AppData\Local\Temp\mailruhomesearch.exe
2017-04-01 16:46 - 2017-03-14 16:08 - 4114192 _____ (Mail.Ru) C:\Users\Admin\AppData\Local\Temp\MailRuUpdater.exe
2017-04-21 22:34 - 2017-04-21 22:36 - 53908408 _____ (Tencent) C:\Users\Admin\AppData\Local\Temp\PCMgr_Setup_12_3_18489_224.exe
2017-04-12 19:36 - 2017-04-17 21:47 - 3830502 _____ () C:\Users\Admin\AppData\Local\Temp\vlngp.exe
2017-04-12 19:46 - 2017-04-17 21:49 - 0754176 _____ () C:\Users\Admin\AppData\Local\Temp\WindowsUpdateKB12695__7428_il1.exe
2017-04-17 21:49 - 2017-04-17 21:50 - 0873845 _____ (                                                            ) C:\Users\Admin\AppData\Local\Temp\Yeadesktop51471.exe
Task: {32AF87C4-42A2-4696-8A9E-B4CD3553BA0C} - System32\Tasks\Milimili => C:\Program Files (x86)\MIO\MIO.exe [2017-02-06] ()
Task: {490D1E40-235A-4330-A958-F74335958529} - \Microsoft\Windows\Multimedia\Manager -> No File <==== ATTENTION
Task: {70D97A28-5927-4F3A-9439-3A6ADC9A5236} - System32\Tasks\{D2EEE39C-1F72-47DD-BB7D-B082B172DBDF} => pcalua.exe -a "C:\Program Files (x86)\Elex-tech\YAC\uninstall.exe"
Task: {FD467D0B-4444-4A3B-9ADE-0733535E4637} - \Microsoft\Windows\Media Center\RegisterObject -> No File <==== ATTENTION
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\QQPCRTP => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\QQPCRTP => ""="service"
FirewallRules: [{22DDE850-99D1-43F5-903D-7ABE3DC20E30}] => (Allow) C:\Program Files\UBar\ubar.exe
FirewallRules: [{96AEC758-6027-4EDA-95A0-D42BF92124D6}] => (Allow) C:\Users\Admin\AppData\Local\Amigo\Application\amigo.exe
FirewallRules: [{01AF257D-5BAA-43EC-9AF4-3EA38A49051B}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\tencentdl.exe
FirewallRules: [{17B7DF93-EC34-437E-9024-5C65A23053E9}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\bugreport_xf.exe
FirewallRules: [{A3EE2852-5B53-43E4-ADFD-2FDCD2CEA5E3}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCTray.exe
FirewallRules: [{5BC6FD82-C06E-475B-B1F6-DBF11E8779C9}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCMgr.exe
FirewallRules: [{00BB8890-F769-4159-B701-A82E4F487D72}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCRTP.exe
FirewallRules: [{AFF100AE-E826-461D-9196-0383D7A064D6}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMDL.exe
FirewallRules: [{9F2D0366-83A5-4C8B-A6B5-AAB2DD6A0A7C}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\bugreport.exe
FirewallRules: [{ED0B8431-A2EF-4113-8243-AB061DD1B672}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCFileOpen.exe
FirewallRules: [{A874EFC0-5200-416A-9978-6627A388F3D2}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCLeakScan.exe
FirewallRules: [{3B277888-2EC0-4A2D-A1BF-35C43C13C754}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPConfig.exe
FirewallRules: [{DF0618AF-4438-4A32-98B0-8BE7A929FA0C}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCSoftMgr.exe
FirewallRules: [{3DD5B5C6-A619-4862-8189-F755A96A1F45}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\plugins\QMNetMon\QQPCNetFlow.exe
FirewallRules: [{A647C8E1-42F6-491A-BDF4-7E0F4A34BBE6}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCBTU.exe
FirewallRules: [{02CC17BD-6A04-403E-A321-668327DA21F3}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCClinic.exe
FirewallRules: [{8CA913F2-3B87-47A1-BB79-F050C410CD49}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCLaunch.exe
FirewallRules: [{BC7260EC-60CD-4C3D-B2BF-5BA83240AC5A}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMUpdate\QQPCMgrUpdate.exe
FirewallRules: [{8ED48755-313F-43C1-8AC8-4532E82DC20D}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCSoftGame.exe
FirewallRules: [{E53092A9-DE24-4874-9F75-63A5FFF3256D}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCSysOptimize.exe
FirewallRules: [{F0A716FB-F454-4CAF-94D8-015B904757F4}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCUpdateAVLib.exe
FirewallRules: [{C5308B2B-BE28-426A-B5AE-EDB19E1A9EB5}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQRepair.exe
FirewallRules: [{18850451-D341-46AD-87D7-A33C2377B87A}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\Uninst.exe
FirewallRules: [{7D3BDB20-6A19-4D18-BC01-2F44857D64C0}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QQPCPatch.exe
FirewallRules: [{1FC87F8B-F68E-428E-A15D-7132A7D27B1D}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\TpkUpdate.exe
FirewallRules: [{079CB1EE-4C45-4141-B048-0982B83EFAAA}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMAccountProtection.exe
FirewallRules: [{F057A34C-2D7B-46F5-88AD-61F9D919F5A0}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17919.214\QMAdBlock.exe
FirewallRules: [{7B418DFA-EB20-4BA9-8D5C-24D6E75B9C9C}] => (Allow) C:\Program Files (x86)\MIO\loader\kingstonxsuv400s37120g_50026b776a0689a2.dat
FirewallRules: [{533FEC97-960C-4480-9977-6F92B81F15FE}] => (Allow) C:\Program Files (x86)\MIO\loader\kingstonxsuv400s37120g_50026b776a0689a2.dat
Reboot:

2. Нажмите Файл – Сохранить как
3. Выберите папку, откуда была запущена утилита Farbar Recovery Scan Tool
4. Укажите Тип файла – Все файлы (*.*)
5. Введите имя файла fixlist.txt и нажмите кнопку Сохранить
6. Запустите FRST, нажмите один раз на кнопку Fix и подождите. Программа создаст лог-файл (Fixlog.txt). Пожалуйста, прикрепите его в следующем сообщении.

• Обратите внимание, что будет выполнена перезагрузка компьютера.

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 1
• Обработано файлов: 12
• В ходе лечения обнаружены вредоносные программы:
  
  1. c:\program files (x86)\coicit schedule\local64spl.dll - Trojan.Win64.Eroyee.uq
  2. c:\users\admin\appdata\local\snarer\snarer.dll - not-a-virus:AdWare.Win64.Snare.a
  3. c:\users\admin\appdata\roaming\event monitor\em.exe - not-a-virus:RiskTool.Win32.SpeedUpMyPC.yyh
  4. c:\users\admin\appdata\roaming\event monitor\isxdl.dll - not-a-virus:RiskTool.Win32.SpeedUpMyPC.yyh
  5. c:\users\admin\appdata\roaming\gplyra\gplyra.exe - not-a-virus:RiskTool.Win64.BitCoinMiner.cab
  6. c:\users\admin\appdata\roaming\mydesktop\linkme.ex e - not-a-virus:AdWare.Win32.Agent.jleq
  7. c:\users\admin\appdata\roaming\winsapsvc\winsap.dl l - not-a-virus:AdWare.Win32.ELEX.bhd