Открываются левые окна, и аваст каждую минуту орёт о вирусе [not-a-virus:VHO:AdWare.Win64.Agent.mqk]

**MorG** · 27.03.2019, 18:40

Открываются левые окна, и аваст каждую минуту орёт о вирусе.

Надоело быть жертвой? Стань профи по информационной безопасности, получай самую свежую информацию об угрозах и средствах защиты от ведущего российского аналитического центра Anti-Malware.ru:

**Info_bot** · 27.03.2019, 18:41

Уважаемый(ая) MorG, спасибо за обращение на наш форум!

Помощь при заражении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы, в самое ближайшее время, ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитой Autologger, подробнее можно прочитать в правилах оформления запроса о помощи.

Информация

Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом Помогите+.

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

**thyrex** · 28.03.2019, 01:18

Выполните скрипт в AVZ из папки Autologger

Код:

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 QuarantineFile('C:\ProgramData\Kolnixo\Jay-Dox.dll','');
 QuarantineFile('C:\Users\Lenovo\AppData\Roaming\CRMSvc\CRMSvc.exe','');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\1038949','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\1049244','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\1592725','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\16TEYG5TSKT8K5L','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\1791329','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\1912344','x64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\cwr2tuhaiiz\u3ta5ge52r0.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\e0mhwyvurp1\cxttodcuuk5.exe','64');
 DeleteFile('C:\Program Files\4IFK1SR4L4\4IFK1SR4L.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\5p3u0khv1se\4ih4t1xtlaa.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\nyzmx4fb2sk\1vq33k1nazs.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\u25zzeaetzu\skid2y4kov5.exe','64');
 DeleteFile('C:\Program Files\MZYFHB4FCO\TMQMC2TIR.exe','64');
 DeleteFile('C:\Program Files\EXQU60OMWK\EXQU60OMW.exe','64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\0A7GBFL4X4Y75GP','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\0KPOOP5UWBED3EI','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\1947454','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\1GZKG418LVMH0G0','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\1KOWJB4SZMYTOJD','x64');
 DeleteFile('C:\Program Files\9GKG8OLYNN\EJFCF0C6Y.exe','64');
 DeleteFile('C:\Program Files\O4KDN6HMTT\O4KDN6HMT.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\2crecat3kxg\vnz0f0kzkbp.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\z45vcuqsv2n\esd0oarszaa.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\sfbgy00x3vy\5nfkx2zavwr.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\5j3cccbsyu5\4ffskowwksw.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\eozkznidzoc\ckgwtm3tp5l.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\xb2p53srmr4\glvm2fr3qg1.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\eudgmchbmrm\lwwgpjq5siu.exe','64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\2530273','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\2473605','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\2401214','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\2200501','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\2169224','x64');
 DeleteFile('C:\Program Files\UIZH4V41IW\UIZH4V41I.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\dnqbznbqlqv\deuzbzx2ryq.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\hjabomaaloe\wtkstodx3jb.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\k2dquv1uqqe\fnuyqhesfm4.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\rbd24lflmot\5fr0y2qolpg.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\mtrl13hugme\xdbqxna0vk1.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\1jwhibarynu\0recok3fcio.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\jxvddn3tr4k\c1mra5pg3rt.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\mixjvm4sqhn\rutbzea1nzf.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\mzjk0m0ozve\jif1nsbrqdj.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\gjip2y40swj\y5typ0jh3ux.exe','64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\3317515','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\3091891','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\306354','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\3038999','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\2978973','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\297718','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\2924759','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\2848222','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\2777122','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\2709947','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\26HY9KP72RL5OAB','x64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\eih1vq2500k\hlqjlqvbgxq.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\d1eluupcebs\lsakmhvrvn5.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\gakkr4m5ih5\jf2lo0v5n4i.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\5leds53tumw\iue0o0fgwec.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\4aitpygaqlo\j4ax1kmpio4.exe','64');
 DeleteFile('C:\Program Files\V6PKOIU578\V6PKOIU57.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\gq0agpqcfle\k44ob0g5eur.exe','64');
 DeleteFile('C:\Program Files\E1PPWWWDFS\E1PPWWWDF.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\s00h4oh0ek5\bmcm2bpl05q.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\mh0qdijycnb\dzehuwyf3da.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\tpcpeuevpc3\3q1xpf1h4e5.exe','64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\4733745','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\4707470','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\4705284','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\468SY345H7B8RQ0','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\4374322','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\41LWSMUMKQY70QV','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\416254','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\3959024','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\3881060','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\3634332','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\3373712','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\4740344','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\4886094','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\5229945','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\5410277','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\5468810','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\5510113','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\5865092','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\5957164','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\5Q7U43XKBO736KK','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\5S9HD6MQJC3MI5A','x64');
 DeleteFile('C:\Program Files\MNQP9U7YXL\MNQP9U7YX.exe','64');
 DeleteFile('C:\Program Files\8GH0QWCQ87\8GH0QWCQ8.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\dmx5non0qgp\fhsgvchdwy0.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\xioqgx5ntac\qbusrzbelcc.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\qqktevzt0xf\2azgqcg5hu3.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\ix5bpoofkte\pbbsf4x3xqh.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\ahydzdmma1j\hohsmdz5q1k.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\n5ugphjhhu4\x1wo5nvqi4e.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\45lfozqjmyj\jgx1e3g00nc.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\2r3sssma1gd\fb41ks2ru1w.exe','64');
 DeleteFile('C:\Program Files\UTBMGR8HWH\UTBMGR8HW.exe','64');
 DeleteFile('C:\Program Files\W0DLCYKI45\W0DLCYKI4.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\tgwjcyv1urq\l3elzloiwco.exe','64');
 DeleteFile('C:\Program Files\OTSDTRQ0ZO\MSZM00KOH.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\z0ssft50fcf\tgfaoagisbq.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\dnb0ls2lvqg\fkyoshrta5y.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\cdmxdkvxo31\0phglkav0ft.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\524mikqobka\axu445jvxfy.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\na3yctith3h\yamu0ng25ac.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\24s1qae0fbb\ktp5vlgxroj.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\qys2fivs21p\qw5jijvf5sn.exe','64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\6101554','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\6108635','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\6119051','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\6124413','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\6274018','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\6613043','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\6618899','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\683FU20U3DZYTVQ','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\6930320','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\6V2N8TRCZF7XUSO','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\6YCZBABRVVSLQGU','x64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\wvmsgn1pxbm\mddq31ouzov.exe','64');
 DeleteFile('C:\Program Files\8F248DPKSN\8F248DPKS.exe','64');
 DeleteFile('C:\Program Files\6NA9XO87ZW\6NA9XO87Z.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\ce2irk2zemf\ca3wuvi511y.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\hw1pjikddki\jfwcdbfpomc.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\1tt054kpwgp\13ljtwvapef.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\xzgvowbf444\4j4qr5rjaka.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\jkhvovpiz1b\5ggerpwi3hw.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\lyxbbnbp02o\ulnfpjxiwi3.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\rdw0t0kb0zr\wvfzvoucvn2.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\3pox1uzh2gx\ej01jssi23j.exe','64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\8880776','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\8727960','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\8684540','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\8597959','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\8575501','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\8285385','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\8270405','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\815040','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\7XI0F49T4KEELUL','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\7MC168LFSEINL80','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\727232','x64');
 DeleteFile('C:\Program Files\6NA9XO87ZW\JCHO5NE8Y.exe','64');
 DeleteFile('C:\Program Files\EMLJ5CX86D\EMLJ5CX86.exe','64');
 DeleteFile('C:\Program Files\Microsoft Analysis Services\ICWAX1M6P56WC6YPDZV7\a&Q-6mm5K5.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\flwkvcb5mo2\ryieehliayk.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\eilewc2wmh1\oetp3vhobea.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\l54vuagkpwd\ls3twtaipbz.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\wl5mws5zhkq\vvg0mc0cdpy.exe','64');
 DeleteFile('C:\Program Files\F09T6MVGSC\ZS3UEPX1L.exe','64');
 DeleteFile('C:\Users\Lenovo\AppData\Roaming\ddq5ma1qa3p\i53uprcucut.exe','64');
 DeleteFile('C:\Program Files\KRW2T8Q29J\KRW2T8Q29.exe','64');
 DeleteFile('C:\Program Files\MWL9M9DJ2T\MWL9M9DJ2.exe','64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\88CEVHYAPGB7MR0','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\8X3JFLA1ZSZEB1N','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\9145339','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\91ZTJPZKG1RVKWP','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\9375806','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\9624432','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\9627627','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\9881567','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\a&Q-6mm5K5.exe','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ARBG1HRPJY731LJ','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\B3S2O24OUGMSYD8','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BMW564XEKWBC4IS','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\C1B9SL5A8648NX8','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CTN9YA9LVN5XSHI','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DT6UWM21TX20VZI','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\EHKPBMD8LZNMSP3','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\EQCKK0TW17NSJR5','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\FVZW2EMGXD18HYC','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\GWF18O7UZ4G62QY','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\H1WRN2L2ZDF181X','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\H9WACJL78QH9NRF','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\HPG9EILN1ZATMYH','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\HT2175IKQ6BIMRW','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\HUVRVQBPD6CYRDA','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\HYM8X6MRFLSDCTV','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\K2S0VF3DJT3RI4C','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LD1JLKMMVFU66TY','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LEUNXVTD2EVJWYM','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LXJS4G4BOC3PM37','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PASJTXLSEPFQUKS','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\YWL2DC5FRZ7MA45','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\YDY6FA0MHIOTA1T','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\YCV2E1M2YD6M7M7','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Y6UEFNMSQJZA3L9','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\XLIVA0I2HDQM8W9','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WEG5T0HC859Y5PH','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Wechat','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\UTNW97SV0TCY9K4','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\U9EC6PCV7KUWHJJ','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\U1MH82H0TP8U1JQ','x64');
 DeleteSchedulerTask('cZAtztbWkvttEsiJa2');
 DeleteSchedulerTask('dPIEEDxCPUYvKtIKKhr2');
 DeleteSchedulerTask('EZDWuPrvwhnlY2');
 DeleteSchedulerTask('JbRbPldPaXVcEk');
 DeleteSchedulerTask('lKLHkisATsnNjPT2');
 DeleteFile('C:\Program Files (x86)\VXIXCZnnU\Dfbzzj.dll','64');
 DeleteFile('C:\Program Files (x86)\JEkILdsaHvdU2\dDDfZbTztzRjE.dll','64');
 DeleteFile('C:\ProgramData\ZJlwACxPIpGmpNVB\uQrTXBt.wsf','64');
 DeleteFile('C:\Program Files (x86)\VBeLgSlZrsYKC\BnHLoTP.dll','64');
 DeleteFile('C:\Program Files (x86)\YFseyhTTSweoDxcixvR\AbqjByc.dll','64');
 DeleteFile('C:\ProgramData\Kolnixo\Via-Hold.reg','64');
 DeleteFile('C:\ProgramData\Kolnixo\Openin.reg','64');
 DeleteFile('C:\ProgramData\Kolnixo\Instock.reg','64');
 DeleteSchedulerTask('psv_Ventoronfresh');
 DeleteSchedulerTask('psv_Toughstock');
 DeleteSchedulerTask('psv_Aping');
 DeleteFile('C:\ProgramData\Kolnixo\Jay-Dox.dll','64');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

Обратите внимание: будет выполнена перезагрузка компьютера.

Выполните скрипт в AVZ

Код:

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

c:\quarantine.zip пришлите по красной ссылке Прислать запрошенный карантин над первым сообщением темы.

Пожалуйста, ЕЩЕ РАЗ запустите Autologger; прикрепите к следующему сообщению НОВЫЕ логи.

**MorG** · 28.03.2019, 18:31

Done

**thyrex** · 28.03.2019, 18:33

Скачайте Farbar Recovery Scan Tool

и сохраните на Рабочем столе.

Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.

1. Запустите программу двойным щелчком. Когда программа запустится, нажмите Yes для соглашения с предупреждением.
2. Убедитесь, что в окне Optional Scan отмечены List BCD, Driver MD5 и 90 Days Files.

3. Нажмите кнопку Scan.
4. После окончания сканирования будет создан отчет (FRST.txt) в той же папке, откуда была запущена программа.
5. Если программа была запущена в первый раз, также будет создан отчет (Addition.txt).
6. Файлы FRST.txt и Addition.txt заархивируйте (в один общий архив) и прикрепите к сообщению.

**MorG** · 28.03.2019, 19:06

Done

**thyrex** · 28.03.2019, 20:36

1. Выделите следующий код:

Код:

Start::
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
AppInit_DLLs: C:\ProgramData\Kolnixo\Jay-Dox.dll => No File
AppInit_DLLs-x32: C:\ProgramData\Kolnixo\Unamatfan.dll => No File
GroupPolicy: Restriction - Chrome <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKU\S-1-5-21-3326413425-253149978-838998017-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBLoO-BhLymRVyoiO2t6mfQOthxKsHXRlGIKQ88UdgKLdO-GYz4_gp9CFF4OjQa6mAAVlu4csfh-73b1eRmXSlDj41J_1jMrc1U4iYLyu5K_ud4bVY2_xB3Kj1w7b4cJuZU6wIiRRpSDO5Fj821G_M7ubLa4EB7x0Cok9bUe3NnF_elGDjoInRCkVDh761oaQ,,&q={searchTerms}
HKU\S-1-5-21-3326413425-253149978-838998017-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBLoO-BhLymRVyoiO2t6mfQOthxKsHXRlGIKQ88UdgKLdO-GYz4_gp9CFF4OjQa6mAAVlu4csfh-73b1eRmXSlDj41J_1jMrc1U4iYLyu5K_ud4bVY2_xB3Kj1w7b4cJuZU6wIiRRpSDO5Fj821G_M7ubLa4EB7x0Cok9bUe3NnF_elGDjoInRCkVDh761oaQ,,&q={searchTerms}
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBLoO-BhLymRVyoiO2t6mfQOthxKsHXRlGIKQ88UdgKLdO-GYz4_gp9CFF4OjQa6mAAVlu4csfh-73b1eRmXSlDj41J_1jMrc1U4iYLyu5K_ud4bVY2_xB3Kj1w7b4cJuZU6wIiRRpSDO5Fj821G_M7ubLa4EB7x0Cok9bUe3NnF_elGDjoInRCkVDh761oaQ,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3326413425-253149978-838998017-1000 -> {ielnksrch} URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBLoO-BhLymRVyoiO2t6mfQOthxKsHXRlGIKQ88UdgKLdO-GYz4_gp9CFF4OjQa6mAAVlu4csfh-73b1eRmXSlDj41J_1jMrc1U4iYLyu5K_ud4bVY2_xB3Kj1w7b4cJuZU6wIiRRpSDO5Fj821G_M7ubLa4EB7x0Cok9bUe3NnF_elGDjoInRCkVDh761oaQ,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3326413425-253149978-838998017-1001 -> DefaultScope {ielnksrch} URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBLoO-BhLymRVyoiO2t6mfQOthxKsHXRlGIKQ88UdgKLdO-GYz4_gp9CFF4OjQa6mAAVlu4csfh-73b1eRmXSlDj41J_1jMrc1U4iYLyu5K_ud4bVY2_xB3Kj1w7b4cJuZU6wIiRRpSDO5Fj821G_M7ubLa4EB7x0Cok9bUe3NnF_elGDjoInRCkVDh761oaQ,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3326413425-253149978-838998017-1001 -> {ielnksrch} URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBLoO-BhLymRVyoiO2t6mfQOthxKsHXRlGIKQ88UdgKLdO-GYz4_gp9CFF4OjQa6mAAVlu4csfh-73b1eRmXSlDj41J_1jMrc1U4iYLyu5K_ud4bVY2_xB3Kj1w7b4cJuZU6wIiRRpSDO5Fj821G_M7ubLa4EB7x0Cok9bUe3NnF_elGDjoInRCkVDh761oaQ,,&q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_181\bin\ssv.dll => No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_181\bin\jp2ssv.dll => No File
C:\Users\Lenovo\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pbdpajcdgknpendpmecafmopknefafha
C:\Users\Lenovo\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\pbdpajcdgknpendpmecafmopknefafha
OPR Extension: (Quick Searcher) - C:\Users\Lenovo\AppData\Roaming\Opera Software\Opera Stable\Extensions\pbdpajcdgknpendpmecafmopknefafha [2018-11-05]
R2 CRMSvc; C:\Users\Lenovo\AppData\Roaming\CRMSvc\CRMSvc.exe [1578496 2019-03-26] () [File not signed] <==== ATTENTION
C:\Users\Lenovo\AppData\Roaming\CRMSvc
2019-03-28 00:27 - 2018-11-05 12:52 - 000000000 ____D C:\Users\Все пользователи\Kolnixo
2019-03-28 00:27 - 2018-11-05 12:52 - 000000000 ____D C:\ProgramData\Kolnixo
2019-03-27 11:46 - 2018-11-05 12:51 - 000000000 ____D C:\Users\Все пользователи\WindowsMenu
2019-03-27 11:46 - 2018-11-05 12:51 - 000000000 ____D C:\ProgramData\WindowsMenu
2019-03-26 17:32 - 2018-11-05 12:51 - 000000000 ____D C:\Users\Lenovo\AppData\Local\William
2019-03-26 17:32 - 2018-11-05 12:51 - 000000000 ____D C:\Program Files (x86)\foldershare
2019-03-26 16:29 - 2018-11-05 12:52 - 000000000 ____D C:\Users\Все пользователи\Logic Cramble
2019-03-26 16:29 - 2018-11-05 12:52 - 000000000 ____D C:\ProgramData\Logic Cramble
2019-03-26 16:25 - 2018-11-05 14:59 - 000000004 _____ C:\Users\Все пользователи\lock.dat
2019-03-26 16:25 - 2018-11-05 14:59 - 000000004 _____ C:\ProgramData\lock.dat
2019-03-26 16:25 - 2018-11-05 12:51 - 000000000 ____D C:\Users\Все пользователи\PrefsSecure
2019-03-26 16:25 - 2018-11-05 12:51 - 000000000 ____D C:\Users\Все пользователи\BetaService
2019-03-26 16:25 - 2018-11-05 12:51 - 000000000 ____D C:\ProgramData\PrefsSecure
2019-03-26 16:25 - 2018-11-05 12:51 - 000000000 ____D C:\ProgramData\BetaService
2018-11-05 12:52 - 2018-11-05 12:52 - 007800320 _____ () C:\Users\Lenovo\AppData\Local\agent.dat
2018-11-05 12:52 - 2018-11-05 12:52 - 000070896 _____ () C:\Users\Lenovo\AppData\Local\Config.xml
2018-11-05 12:51 - 2018-11-05 12:51 - 000017664 _____ () C:\Users\Lenovo\AppData\Local\InstallationConfiguration.xml
2018-11-05 12:51 - 2018-11-05 12:51 - 000140800 _____ () C:\Users\Lenovo\AppData\Local\installer.dat
2018-11-05 12:52 - 2018-11-05 12:52 - 000005568 _____ () C:\Users\Lenovo\AppData\Local\md.xml
2018-11-05 12:52 - 2018-11-05 12:52 - 000126464 _____ () C:\Users\Lenovo\AppData\Local\noah.dat
30598-05-30 11:27 - 30598-05-30 11:27 - 000073216 ____N (Microsoft Corporation) C:\Users\Lenovo\AppData\Local\NyiquiSaMuyp.exe
2018-11-05 12:51 - 2018-11-05 15:28 - 000722944 _____ () C:\Users\Lenovo\AppData\Local\sham.db
2018-11-05 12:52 - 2018-11-05 12:52 - 002020378 _____ () C:\Users\Lenovo\AppData\Local\Sontone.tst
2017-11-27 14:41 - 2017-11-27 14:41 - 000000757 _____ () C:\Users\Lenovo\AppData\Local\uBar.lnk
2018-11-05 12:52 - 2018-11-05 12:52 - 000032038 _____ () C:\Users\Lenovo\AppData\Local\uninstall_temp.ico
2018-11-05 12:51 - 2018-11-05 12:51 - 000000003 _____ () C:\Users\Lenovo\AppData\Local\wbem.ini
FirewallRules: [{EADAC3A1-CAB2-4C1E-955D-11182C83BAF7}] => (Allow) C:\Program Files\Opera\56.0.3051.52\opera.exe No File
FirewallRules: [{B618D2B4-B9AE-4DB4-B63A-7BDA4A837955}] => (Allow) C:\ProgramData\WindowsMenu\westat.exe No File
FirewallRules: [{68CF5B11-169E-48A2-8A23-157BF7E6D3A9}] => (Allow) C:\ProgramData\WindowsMenu\westat.exe No File
FirewallRules: [{1C47E48A-570A-43A5-A9CB-EBCC9369DD40}] => (Allow) C:\ProgramData\WindowsMenu\westat.exe No File
FirewallRules: [{B2DD7B66-AC1B-4F32-A962-F8E2FEFF5038}] => (Allow) C:\ProgramData\WindowsMenu\westat.exe No File
FirewallRules: [TCP Query User{EFF5D352-2353-4C2B-B8BC-4982F8EC8BAD}C:\program files\java\jre1.8.0_181\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_181\bin\javaw.exe No File
FirewallRules: [UDP Query User{47B35981-BFAE-4D8D-9793-8EEA288BED5F}C:\program files\java\jre1.8.0_181\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_181\bin\javaw.exe No File
FirewallRules: [TCP Query User{74E21672-8B63-4DF0-B872-E2E5B547AC15}D:\counter-strike 1.6 russian\hl.exe] => (Allow) D:\counter-strike 1.6 russian\hl.exe No File
FirewallRules: [UDP Query User{7E644AA3-2A5D-40E2-BC6B-B57BABA3F5BC}D:\counter-strike 1.6 russian\hl.exe] => (Allow) D:\counter-strike 1.6 russian\hl.exe No File
FirewallRules: [TCP Query User{EE189AA4-FB04-4F38-9080-5E6FB1C1DDF7}D:\counter-strike 1.6 russian\hl.exe] => (Allow) D:\counter-strike 1.6 russian\hl.exe No File
FirewallRules: [UDP Query User{6CBA483B-5126-4880-A7C8-B6B8850D356F}D:\counter-strike 1.6 russian\hl.exe] => (Allow) D:\counter-strike 1.6 russian\hl.exe No File
FirewallRules: [{10A2AD1B-2ADB-4092-8061-643D3A282A47}] => (Allow) C:\Program Files\Opera\56.0.3051.43\opera.exe No File
FirewallRules: [{6AAF5F6C-9BE4-4B2F-9F4A-FDF02EEE757F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe No File
FirewallRules: [{D608ED2F-0904-4E59-96D1-270E8F8F02E6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe No File
FirewallRules: [{76D6D694-966E-4D8B-A808-002D1643B41B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe No File
FirewallRules: [{16D6C8B0-80FC-4848-86D8-883B64187321}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe No File
FirewallRules: [{C56D77A8-DDD9-4773-AFA6-A8303DE13363}] => (Allow) D:\Новая папка\Steam.exe No File
FirewallRules: [{3D6F4CEA-6F58-4A7A-AE96-6BC4D668C801}] => (Allow) D:\Новая папка\Steam.exe No File
FirewallRules: [{CD98F762-F15D-417A-9E64-0CF95932B82C}] => (Allow) D:\Steam\Steam.exe No File
FirewallRules: [{2F308C85-74A5-42AE-9FB0-D2944B9EE82D}] => (Allow) D:\Steam\Steam.exe No File
FirewallRules: [{0A89394C-E2C5-495F-A35E-A62DE8E92FA2}] => (Allow) D:\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
FirewallRules: [{BFCD9F1D-17B1-4134-9931-0196F87E6CED}] => (Allow) D:\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
FirewallRules: [{37E4DE5E-4BA9-4839-813E-CEC3AFCDD411}] => (Allow) D:\AAA\Battlefield 3\bf3.exe No File
FirewallRules: [{AA1E66D0-5A1E-4F80-8E92-54D9B4196CE2}] => (Allow) D:\AAA\Battlefield 3\bf3.exe No File
FirewallRules: [TCP Query User{C29399DE-3871-4311-8296-4DB2E18A3468}D:\aaa\battlefield 4\bf4.exe] => (Allow) D:\aaa\battlefield 4\bf4.exe No File
FirewallRules: [UDP Query User{D26192F8-2A85-4467-A744-7DF9AAA68C30}D:\aaa\battlefield 4\bf4.exe] => (Allow) D:\aaa\battlefield 4\bf4.exe No File
FirewallRules: [TCP Query User{E69DF767-AE18-4F7D-846B-E294F55F189E}D:\starcraft ii\versions\base66668\sc2_x64.exe] => (Block) D:\starcraft ii\versions\base66668\sc2_x64.exe No File
FirewallRules: [UDP Query User{6B7068D0-7705-42D1-8CD8-072DA50BF777}D:\starcraft ii\versions\base66668\sc2_x64.exe] => (Block) D:\starcraft ii\versions\base66668\sc2_x64.exe No File
FirewallRules: [TCP Query User{5CC19FB7-589F-40A5-8DA3-31D58019FE60}C:\users\lenovo\appdata\local\mediaget2\mediaget.exe] => (Block) C:\users\lenovo\appdata\local\mediaget2\mediaget.exe No File
FirewallRules: [UDP Query User{E4741A17-74F7-4858-915C-A7BA205A0555}C:\users\lenovo\appdata\local\mediaget2\mediaget.exe] => (Block) C:\users\lenovo\appdata\local\mediaget2\mediaget.exe No File
FirewallRules: [TCP Query User{AE3FA587-CCF8-4A40-92DA-EF1F69069C56}C:\programdata\ubar\ubar\ubar.exe] => (Allow) C:\programdata\ubar\ubar\ubar.exe No File
FirewallRules: [UDP Query User{DE286834-32D3-43BF-8AAE-2C3C38F6FB32}C:\programdata\ubar\ubar\ubar.exe] => (Allow) C:\programdata\ubar\ubar\ubar.exe No File
FirewallRules: [{087D059D-2A61-41F4-8F88-CB0A064488A5}] => (Allow) C:\Users\Lenovo\AppData\Local\Temp\7zS08E6\ProductInst64.exe No File
FirewallRules: [{FEE7F585-D6EF-4AC5-830C-2289C643E5A4}] => (Allow) C:\Users\Lenovo\AppData\Local\Temp\7zS08E6\ProductInst64.exe No File
MSCONFIG\startupreg: 1970489 => "C:\Users\Lenovo\AppData\Roaming\2crecat3kxg\vnz0f0kzkbp.exe" /VERYSILENT
MSCONFIG\startupreg: R3IMV2OWEYJ0KSX => "C:\Program Files\FEEO5VS3TI\FEEO5VS3T.exe"
MSCONFIG\startupreg: SCUO9I5P7JV5042 => "C:\Program Files\2NQVZRNWCF\FCWA7QTXC.exe"
MSCONFIG\startupreg: SE8GVRG0TMZIKKF => "C:\Program Files\V8PT7VF7X8\V8PT7VF7X.exe"
AlternateDataStreams: C:\ProgramData\TEMP:D8999815 [456]
AlternateDataStreams: C:\Users\Все пользователи\TEMP:D8999815 [456]
Task: {B1204850-23B8-4131-B33F-237CBD347399} - \{0C8A12BE-E3BD-3D19-D3AB-88E9FBD8D2FF} -> No File <==== ATTENTION
Folder: C:\Program Files (x86)\Sound
Reboot:
End::

2. Скопируйте выделенный текст (правая кнопка мыши – Копировать).
3. Запустите Farbar Recovery Scan Tool.
4. Нажмите один раз на кнопку Fix и подождите. Программа создаст лог-файл (Fixlog.txt). Пожалуйста, прикрепите его в следующем сообщении.

Обратите внимание: будет выполнена перезагрузка компьютера.

**MorG** · 29.03.2019, 10:49

Done

**thyrex** · 29.03.2019, 13:50

Что с проблемой?

**MorG** · 29.03.2019, 14:24

Сообщение от thyrex

Что с проблемой?

Похоже нет, благодарю.

**CyberHelper** · 29.03.2019, 14:34

=D1=F2=E0=F2=E8=F1=F2=E8=EA=E0 =EF=F0=EE=E2=E5=E4=E5=ED=ED=EE=E3=EE =EB=
=E5=F7=E5=ED=E8=FF:

=CF=EE=EB=F3=F7=E5=ED=EE =EA=E0=F0=E0=ED=F2=E8=ED=EE=E2: 1
=CE=E1=F0=E0=E1=EE=F2=E0=ED=EE =F4=E0=E9=EB=EE=E2: 2
=C2 =F5=EE=E4=E5 =EB=E5=F7=E5=ED=E8=FF =EE=E1=ED=E0=F0=F3=E6=E5=ED=FB=
=E2=F0=E5=E4=EE=ED=EE=F1=ED=FB=E5 =EF=F0=EE=E3=F0=E0=EC=EC=FB:
1. c:\programdata\kolnixo\jay-dox.dll - not-a-virus:VHO:AdWare.=
  Win64.Agent.mqk

Открываются левые окна, и аваст каждую минуту орёт о вирусе [not-a-virus:VHO:AdWare.Win64.Agent.mqk] (заявка № 222381)

Опции темы