Удалите программы:
eShield Browser Security
FlvPlayer
DNSUnlocker
Откройте Блокнот (Старт =>Программы => Стандартные => Блокнот). Скопируйте в него следующий код:
Код:
CreateRestorePoint:
Tcpip\..\Interfaces\{1db4209b-00a7-4763-a63f-6d8371fb4ac5}: [NameServer] 82.163.142.7 95.211.158.134
SearchScopes: HKU\S-1-5-21-2825347086-2981257662-4213469737-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.eshield.com/serp?guid={1ED4791B-A481-4AE8-89EE-AF6F81FDEFAD}&action=default_search&k={searchTerms}
SearchScopes: HKU\S-1-5-21-2825347086-2981257662-4213469737-1000 -> {5FBC36E2-AD3B-4E43-A2BC-E81DD96FE970} URL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=11467
SearchScopes: HKU\S-1-5-21-2825347086-2981257662-4213469737-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={SearchTerms}&fr=ntg&gp=custom2
Toolbar: HKLM - eShield - {898E8883-5181-4959-B230-E3C01F807653} - C:\Program Files (x86)\TNT2\2.0.0.1995\IEToolbar64.dll No File
FF Plugin HKU\S-1-5-21-2825347086-2981257662-4213469737-1000: @tnt2npapi.com/Plugin -> C:\Users\27972\AppData\Local\TNT2\2.0.0.1995\npTNT2.dll [2015-08-12] (Eshield)
FF Extension: eShield - C:\Users\27972\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\Extensions\toolbar11467@eshield.com [2015-08-12] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [{C7AE725D-FA5C-4027-BB4C-787EF9F8248A}] - C:\Program Files (x86)\PremierOpinion\firefox => not found
CHR StartupUrls: Default -> "hxxp://mail.ru/cnt/10445?gp=custom2"
CHR Extension: (eShield) - C:\Users\27972\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkmjljdbbgogihjcapfhgkonfmccbffp [2016-05-27]
CHR HKLM-x32\...\Chrome\Extension: [dkmjljdbbgogihjcapfhgkonfmccbffp] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [mkndcbhcgphcfkkddanakjiepeknbgle] - C:\Program Files (x86)\PremierOpinion\pmcm.crx <not found>
2016-06-27 00:21 - 2016-06-27 00:21 - 00768416 _____ (Reimage) C:\Users\27972\Downloads\ReimageRepair.exe
2016-06-26 21:50 - 2016-06-26 21:50 - 00000000 ____D C:\Users\Все пользователи\db7f6d9d-75c1-0
2016-06-26 21:44 - 2016-06-26 21:44 - 00000000 ____D C:\ProgramData\db7f6d9d-02f3-0
2016-06-26 21:44 - 2016-06-26 21:44 - 00000000 ____D C:\ProgramData\{26866dc3-512c-1}
2016-06-26 21:44 - 2016-06-26 21:44 - 00000000 ____D C:\ProgramData\{09b7bbd4-712c-0}
2016-06-26 21:44 - 2016-06-26 21:44 - 00000000 ____D C:\ProgramData\{0162428d-412c-0}
2016-06-26 21:44 - 2016-05-27 00:26 - 00000000 ____D C:\ProgramData\3126b259-3dd3-1
2016-06-26 21:46 - 2016-05-27 00:26 - 00000000 ____D C:\ProgramData\3126b259-4237-0
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1" /f
CMD: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1" /f /reg:32
CustomCLSID: HKU\S-1-5-21-2825347086-2981257662-4213469737-1000_Classes\CLSID\{898E8883-5181-4959-B230-E3C01F807653}\InprocServer32 -> C:\Program Files (x86)\TNT2\2.0.0.1995\IEToolbar64.dll => No File
Task: {04286734-0F4D-43E1-BE2A-CF0B7DD01ED6} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {0AAC9C26-4AAF-4C4D-B90D-2489D61714ED} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {0B7BBD80-430A-476D-B678-8EDDCA121BA9} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {12B838E5-C1C1-4EA9-8535-D6935A0C9E94} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {1BCAB131-35CA-4C39-8B40-A2098BB4F383} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {207D6D67-D876-4965-9483-CAC6E342D97E} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {4506E1FD-1940-479E-9FE8-5696BE4EF939} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {459AFBDA-EC2E-482F-BD05-02DD7F03E868} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {90887EF0-1C10-43DD-81D9-03145CBEF6FF} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {BF49698C-208E-4ADA-9D68-596C02EFE74B} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {EB591647-3C8C-420B-B1CB-C991F132BDC5} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {F500A4D5-360F-4335-8DCF-7186F3402AE8} - System32\Tasks\DNSPLUM => dnsplum.exe <==== ATTENTION
FirewallRules: [{867E74C6-BA1E-496C-9941-3EEAAE6A9635}] => (Allow) C:\Users\27972\AppData\Local\TNT2\2.0.0.1995\TNT2User.exe
FirewallRules: [{53A4E74B-F476-4903-A7D6-02B5FCCE3A40}] => (Allow) C:\Program Files (x86)\PremierOpinion\pmropn.exe
FirewallRules: [{A6656C16-9533-45E2-84B2-0D8BFDFFE242}] => (Allow) C:\Program Files (x86)\PremierOpinion\pmropn.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateAdmin
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PremierOpinion
C:\Users\27972\AppData\Local\TNT2
CMD: ipconfig /flushdns
EmptyTemp:
Reboot:
и сохраните как fixlist.txt в папку с Farbar Recovery Scan Tool.
Отключите до перезагрузки антивирус,
закройте все браузеры, запустите FRST, нажмите
Fix и подождите. Программа создаст лог-файл (
Fixlog.txt). Прикрепите его к своему следующему сообщению.
Компьютер будет перезагружен автоматически.
Сообщите, что с проблемой.
