Выполните скрипт в Farbar Recovery Scan Tool
Лог, который будет создан после выполнения скрипта, прикрепите к сообщению.
Код:
start
CreateRestorePoint:
AlternateDataStreams: C:\Windows\system32\drivers:ucdrv-x64.sys [25444]
AlternateDataStreams: C:\Windows\system32\drivers:x64 [1498914]
AlternateDataStreams: C:\Windows\system32\drivers:x86 [1223458]
AlternateDataStreams: C:\ProgramData\TEMP:28AE6654 [169]
AlternateDataStreams: C:\Users\Public\DRM:احتضان [48]
AlternateDataStreams: C:\Users\Все пользователи\TEMP:28AE6654 [169]
R1 ucdrv; C:\Windows\System32\drivers:ucdrv-x64.sys [25444 ] (UC Web Inc.) <==== ATTENTION
HKU\S-1-5-18\...\Run: [] => [X]
HKLM\...\Providers\4aem8v9z: C:\Program Files (x86)\Anipertheratpeph Manager\local64spl.dll
GroupPolicy: Restriction - Chrome <======= ATTENTION
GroupPolicy\User: Restriction <======= ATTENTION
GroupPolicyScripts: Restriction <======= ATTENTION
CHR DefaultSearchKeyword: ChromeDefaultData -> youndoo
CHR Profile: C:\Users\Lagos_official_admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-03-29] <==== ATTENTION
CHR Profile: C:\Users\Lagos_official_admin\AppData\Local\Google\Chrome\User Data\Default_bag [2017-03-29] <==== ATTENTION
StartMenuInternet: (HKLM) Operabeta - C:\Program Files (x86)\Opera Next\Launcher.exe hxxp://www.startpageing123.com/?type=sc&ts=1490774628&z=34e7f897ee5784006059bb7g6z3t5ebmam7z0qeobq&from=che0812&uid=ADATAXSP900_7D5120007721
CHR DefaultSearchURL: ChromeDefaultData -> hxxp://www.youndoo.com/search/?q={searchTerms}&z=fe116fe6f3d9194ecff32a3g3z3t0e6q3oetcg8qbt&from=wak&uid=ADATAXSP900_7D5120007721&type=sp
2017-03-28 00:39 - 2017-03-30 14:47 - 00000000 ____D C:\Program Files (x86)\Chermock
2017-03-28 00:39 - 2017-03-28 00:39 - 00000000 ____D C:\Program Files (x86)\MIO
2017-03-27 21:49 - 2017-03-27 21:49 - 02978349 _____ C:\Users\Lagos_official_admin\AppData\Roaming\codecswift.exe
2017-03-27 21:49 - 2017-03-27 21:49 - 0000040 _____ () C:\Users\Lagos_official_admin\AppData\Roaming\CDManager.exe.sha1
2017-03-27 21:49 - 2017-03-27 21:49 - 2978349 _____ () C:\Users\Lagos_official_admin\AppData\Roaming\codecswift.exe
2017-03-27 21:49 - 2017-03-27 21:49 - 0000040 _____ () C:\Users\Lagos_official_admin\AppData\Roaming\codecswift.exe.sha1
2017-03-27 18:41 - 2017-03-27 18:41 - 1156096 _____ () C:\Users\Lagos_official_admin\AppData\Roaming\Transphase.exe
2017-03-27 21:49 - 2017-03-27 22:13 - 0000040 _____ () C:\Users\Lagos_official_admin\AppData\Roaming\vof.exe.sha1
2017-03-27 21:49 - 2017-03-27 21:49 - 0000040 _____ () C:\Users\Lagos_official_admin\AppData\Roaming\WinJar.exe.sha1
2017-03-27 18:41 - 2017-03-27 18:41 - 1156096 _____ () C:\Users\Lagos_official_admin\AppData\Roaming\Xxx-kix.exe
EmptyTemp:
Reboot:
end
Что с проблемами?
Смените пароли.
