Отключите до перезагрузки антивирус.
Выделите следующий код:
Start::
CreateRestorePoint:
CloseProcesses:
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {0B84CDEE-963C-4E5A-A12B-0314E3DD5891} - \dominantentfen -> No File <==== ATTENTION
Task: {0C11F5AB-CD96-4749-BE00-3629F2CFB840} - \Universal\Driver Updater\Start Driver Updater automatic scanning -> No File <==== ATTENTION
Task: {1980A854-AEAE-428B-B603-F7F1B3B34C70} - \{B53BF3C0-66AF-FAFE-256C-BEFD9AC8F113} -> No File <==== ATTENTION
Task: {1DA77142-FE86-49B3-88BE-95687882A481} - \good-journalnetfumxs -> No File <==== ATTENTION
Task: {301A5A4E-BDF3-489B-A35E-43353700CF60} - System32\Tasks\RunAtStartup => C:\Users\TEMP.Dimon.005\AppData\Roaming\Event Monitor\em.exe <==== ATTENTION
Quarantine: C:\Users\TEMP.Dimon.005\AppData\Roaming\Event Monitor\em.exe
Task: {362E8895-F6B1-491A-B407-9BA6492E74DC} - \{050D0547-0F7A-0F7F-0511-05097979110C} -> No File <==== ATTENTION
Task: {4138A894-920A-4524-B3D0-E7F7C67BEBD2} - \Standart Private Mgr -> No File <==== ATTENTION
Task: {6400E72C-2F95-4FF1-88C7-D8DEA886428A} - \Account Render Mgr -> No File <==== ATTENTION
Task: {6D87FBCF-B9B9-40F8-8A45-5D757104C1E6} - \Checker64 -> No File <==== ATTENTION
Task: {8283C39A-27EA-407E-87DF-1D85306DB106} - \{0F097E47-7A7E-7F0F-0C11-0A0A7D7A117A} -> No File <==== ATTENTION
Task: {9D3AF3A2-5B27-4812-8E08-8FE13AE17972} - \hdtask -> No File <==== ATTENTION
Task: {9DB7E0A0-380E-455B-914F-CFE0804931F1} - System32\Tasks\My top apps => C:\Users\Dima\AppData\Roaming\My-top-apps\My-top-apps.exe
Task: {A1E69F70-1B1E-496A-A22C-6662272B3E03} - \8CAC39BE-449C-8B93-F61E-DD9CE5FF89D4 -> No File <==== ATTENTION
Task: {B68F4086-D995-49C5-9006-9DB73541E4BB} - \{C6F4A039-715F-1792-0163-5C877B70FAFC} -> No File <==== ATTENTION
Task: {CBB8C32A-38A7-4457-BEB2-CFFF74612AB5} - \2infoblognetunorsm -> No File <==== ATTENTION
Task: {D68938C6-7887-4A26-ACEC-C3DBA7345666} - \InternetED -> No File <==== ATTENTION
Task: {E4FED76D-0F90-42E7-AD3F-0535D6D390C2} - \Soft installer -> No File <==== ATTENTION
Task: {EED6C463-5E7E-4ED6-966F-13726361361F} - \wd-client -> No File <==== ATTENTION
Task: {F28EE749-A30D-4F45-8EC7-6F8AFB3933CF} - \System Command Helper -> No File <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
SearchScopes: HKU\S-1-5-21-2137299756-1173252096-2950031026-1000 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={searchTerms}&fr=ntg&product_id=%7BEADDD407-BDE9-4292-8E70-02C1F9786F5E%7D&gp=843056
SearchScopes: HKU\S-1-5-21-2137299756-1173252096-2950031026-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={searchTerms}&fr=ntg&product_id=%7BEADDD407-BDE9-4292-8E70-02C1F9786F5E%7D&gp=843056
FF user.js: detected! => C:\Users\Dima\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\user.js [2017-07-12]
FF Extension: (No Name) - C:\Users\Dima\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\Extensions\1779-aad0-16ad-36e5 [2017-05-31] [not signed]
FF Extension: (Домашняя страница Mail.Ru) - C:\Users\Dima\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\Extensions\homepage@mail.ru. xpi [2018-01-23] [UpdateUrl:hxxps://crxmailru.cdnmail.ru/go_ffhp_update.json]
FF Extension: (Поиск Mail.Ru) - C:\Users\Dima\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\Extensions\search@mail.ru.xp i [2018-01-23] [UpdateUrl:hxxps://crxmailru.cdnmail.ru/searchff/update.json]
FF Extension: (Пульт) - C:\Users\Dima\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\Extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}.xpi [2018-01-23] [UpdateUrl:hxxps://crxmailru.cdnmail.ru/ff_pult/update.json]
CHR StartupUrls: Default -> "hxxp://mail.ru/cnt/10445?gp=802811"
CHR NewTab: Default -> "active": false,
C:\Users\Dima\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhjhnafpiilpffhglajcaepjbnbjemci
C:\Users\Dima\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck
CHR HKU\S-1-5-21-2137299756-1173252096-2950031026-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ldgpjdiadomhinpimgchmeembbgojnjk] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bejnpnkhfgfkcpgikiinojlmdcjimobi] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bhjcgomkanpkpblokebecknhahgkcmoo] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bhjhnafpiilpffhglajcaepjbnbjemci]
CHR HKLM-x32\...\Chrome\Extension: [ccfifbojenkenpkmnbnndeadpfdiffof]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki]
CHR HKLM-x32\...\Chrome\Extension: [hpcghcdjnehpkdecaflpedhklimnejia] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [oelpkepjlgmehajehfeicfbjdiobdkfj]
CHR HKLM-x32\...\Chrome\Extension: [ojlcebdkbpjdpiligkdbbkdkfjmchbfd]
C:\Users\Dima\AppData\Roaming\Opera Software\Opera Stable\Extensions\kcknbenjnkkjknphmnidanjifbgphjke
S2 ihctrl32; %SystemRoot%\System32\ihctrl32.dll [X]
S2 wsaudio; %SystemRoot%\System32\wsaudio.dll [X]
2020-01-21 14:07 - 2016-07-26 16:46 - 000000000 ____D C:\ProgramData\Kaspersky Lab
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
Shortcut: C:\Users\Dima\AppData\Local\Amigo\User Data\Default\Web Applications\_crx_mbipmajmbfjakbcfnjdldckninlnmhoe\Амиго.Музыка.lnk -> C:\Users\Dima\AppData\Local\Amigo\Application\amigo.exe (No File) <==== Cyrillic
Zip: c:\FRST\Quarantine\
EmptyTemp:
Reboot:
End::
Скопируйте выделенный текст (правой кнопкой - Копировать).
Запустите FRST (FRST64) от имени администратора.
Нажмите Fix один раз (!) и подождите. Программа создаст лог-файл (Fixlog.txt). Прикрепите его к своему следующему сообщению.
Компьютер будет перезагружен автоматически.
На рабочем столе появится архив Date_Time.zip (Дата_Время)
Отправьте его на этот почтовый ящик: quarantine <at> safezone.cc (замените <at> на @) с указанием ссылки на тему в теме (заголовке) сообщения и с указанием пароля: virus в теле письма.
Подробнее читайте в этом руководстве ('http://safezone.cc/threads/17760/').