[shestale]

Вам нужна помощь? Нам нужны ваши логи!

[Lagos]

shestale, готово.
Архив.

[shestale]

Все логи, кроме карантинов, выкладываем на форум:
Screenshot_2.jpg

[Lagos]

shestale, Вот.

[shestale]

Закройте все программы, временно выгрузите антивирус, файрволл и прочее защитное ПО.

Выполните скрипт в АВЗ (Файл - Выполнить скрипт):

Код:

begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
 QuarantineFileF('c:\users\lagos_official_admin\appdata\roaming\kyubey', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\users\lagos_official_admin\appdata\roaming\winsapsvc', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\users\lagos_official_admin\appdata\roaming\winsnare', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\users\lagos_official_admin\appdata\roaming\browsers', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\progra~2\fixit', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\users\lagos_official_admin\appdata\roaming\forceupdatevof', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\users\lagos_official_admin\appdata\local\filterstart', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\users\lagos_official_admin\appdata\roaming\event monitor', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\users\lagos_official_admin\appdata\roaming\searchay', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\program files (x86)\screenup', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\users\lagos_official_admin\appdata\roaming\vof', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\users\lagos_official_admin\appdata\roaming\vofer', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFile('c:\users\lagos_official_admin\appdata\roaming\kyubey\kyubey.exe', '');
 QuarantineFile('c:\users\lagos_official_admin\appdata\roaming\winsapsvc\winsap.dll', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\WINSNARE\WinSnare.dll', '');
 QuarantineFile('C:\Windows\MicrosoftU\csrss.exe', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Browsers\exe.rehcnual.bat', '');
 QuarantineFile('C:\Program Files (x86)\Anipertheratpeph Manager\local64spl.dll', '');
 QuarantineFile('C:\PROGRA~2\FixIt\FIXITM~1.EXE', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\ForceUpdateVOF\ml.py', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\ForceUpdateVOF\python\pythonw.exe', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\ForceUpdateVOF\updater.py', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Adobe\Manager.exe', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Local\FilterStart\FilterStart.exe', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Event Monitor\em.exe', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\SearchAY\ml.py', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\SearchAY\python\pythonw.exe', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\SearchAY\app.py', '');
 QuarantineFile('C:\ProgramData\smp2.exe', '');
 QuarantineFile('C:\Program Files (x86)\ScreenUp\future_helper.exe', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\VOF\ml.py', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\VOF\python\pythonw.exe', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\VOF\updater.py', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\vofer\ml.py', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\vofer\python\pythonw.exe', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\vofer\app.py', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Панель запуска приложений Chrome.lnk', '');
 QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gоoglе Chrome.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Local\Yeshat\User Data\ChromeDefaultData\Web Applications\_crx_blpcfgokakmgnkcojhhkbfbldkacnbeo\YouTube.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Web Applications\_crx_blpcfgokakmgnkcojhhkbfbldkacnbeo\YouTube.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Приложения Uran\VK inviz.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Приложения Uran\VKontakte Offline.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Local\Drbszqergh\ChromeDefaultData\Web Applications\_crx_blpcfgokakmgnkcojhhkbfbldkacnbeo\YouTube.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\Desktop\Софт\Браузеры\Mozilla Firefox.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mail.Ru.lnk', '');
 QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TakeOwnershipEx\TakeOwnershipEx Site.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet-Explorer Browser.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk', '');
 QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk', '');
 QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk', '');
 QuarantineFile('C:\Users\Public\Desktop\Mozilla Firefox.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\Desktop\Софт\Браузеры\Internet Explorer (64-bit).lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Gооglе Сhrome.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunсh Internеt Eхрlorer Brоwser.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Yаndех.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Yаndex.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Intеrnet Еxplоrer (No Add-ons).lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnet Exрlorer.lnk', '');
 QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Моzillа Firеfox.lnk', '');
 QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WCF RIA Services V1.0 SP1\Stаrt Нerе.lnk', '');
 QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WCF RIA Services V1.0 SP1\WСF RIА Servicеs V1.0 SР1 Walkthrough.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Ореrа betа.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yandex\Yаndех.lnk', '');
 QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ореrа beta.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\Desktop\Игры\Мinеcraft.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\Desktop\Игры\SkyrimLаuncher.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\Desktop\Игры\Wаrframe.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Warframe\Wаrfrаmе.lnk', '');
 QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft DirectX SDK (June 2010)\DirеctХ Sаmрlе Browsеr.lnk', '');
 QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Minecraft\Мinесraft.lnk', '');
 QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R.G. Mechanics\Euro Truck Simulator 2\Игрaть Eurо Truck Simulatоr 2 (х32).lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\Хм\Desktop\RS File Recovery.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\Хм\Desktop\RS NTFS Recovery.lnk', '');
 QuarantineFile('C:\ProgramData\ReviverSoft\Start Menu Reviver\S-1-5-21-3392820279-1211771211-2562909350-500\dashboard.lnk', '');
 QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ReviverSoft\Start Menu Reviver\Uninstall.lnk', '');
 QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ReviverSoft\Start Menu Reviver\Start Menu Reviver.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\Desktop\Софт\Программирование\Android\Adb Run.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Yandex.lnk', '');
 QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera beta.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Opera beta.lnk', '');
 QuarantineFile('C:\Users\Lagos_official_admin\Хм\Favorites\Mail.Ru.url', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Browsers\exe.rehcnual.bat', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Browsers\exe.resworb.bat', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Browsers\exe.rehcnualt.bat', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Browsers\exe.rehcnualmiryks.bat', '');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Browsers\exe.resworbelpmas.bat', '');
 ExecuteFile('schtasks.exe', '/delete /TN "Fix It Task" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "ForceUpdateVOF" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "ForceUpdateVOF2" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "Microsoft\Windows\Multimedia\Manager" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "Milimili" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "PC Custom Manager" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "RunAtStartup" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "SearchAY" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "SearchAY2" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "SMW_P" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "System PC Manager" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "VOF" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "VOF2" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "vofer" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "vofer2" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "{09050B47-0C7D-0B0F-7E11-7E787D051109}" /F', 0, 15000, true);
 DeleteFile('c:\users\lagos_official_admin\appdata\roaming\kyubey\kyubey.exe', '32');
 DeleteFile('c:\users\lagos_official_admin\appdata\roaming\winsapsvc\winsap.dll', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\WINSNARE\WinSnare.dll', '32');
 DeleteFile('C:\Windows\MicrosoftU\csrss.exe', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\Browsers\exe.rehcnual.bat', '32');
 DeleteFile('C:\Program Files (x86)\Anipertheratpeph Manager\local64spl.dll', '32');
 DeleteFile('C:\PROGRA~2\FixIt\FIXITM~1.EXE', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\ForceUpdateVOF\ml.py', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\ForceUpdateVOF\python\pythonw.exe', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\ForceUpdateVOF\updater.py', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\Adobe\Manager.exe', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Local\FilterStart\FilterStart.exe', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\Event Monitor\em.exe', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\SearchAY\ml.py', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\SearchAY\python\pythonw.exe', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\SearchAY\app.py', '32');
 DeleteFile('C:\ProgramData\smp2.exe', '32');
 DeleteFile('C:\Program Files (x86)\ScreenUp\future_helper.exe', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\VOF\ml.py', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\VOF\python\pythonw.exe', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\VOF\updater.py', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\vofer\ml.py', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\vofer\python\pythonw.exe', '32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\vofer\app.py', '32');
 DeleteFileMask('c:\users\lagos_official_admin\appdata\roaming\kyubey', '*', true);
 DeleteFileMask('c:\users\lagos_official_admin\appdata\roaming\winsapsvc', '*', true);
 DeleteFileMask('c:\users\lagos_official_admin\appdata\roaming\winsnare', '*', true);
 DeleteFileMask('c:\users\lagos_official_admin\appdata\roaming\browsers', '*', true);
 DeleteFileMask('c:\progra~2\fixit', '*', true);
 DeleteFileMask('c:\users\lagos_official_admin\appdata\roaming\forceupdatevof', '*', true);
 DeleteFileMask('c:\users\lagos_official_admin\appdata\local\filterstart', '*', true);
 DeleteFileMask('c:\users\lagos_official_admin\appdata\roaming\event monitor', '*', true);
 DeleteFileMask('c:\users\lagos_official_admin\appdata\roaming\searchay', '*', true);
 DeleteFileMask('c:\program files (x86)\screenup', '*', true);
 DeleteFileMask('c:\users\lagos_official_admin\appdata\roaming\vof', '*', true);
 DeleteFileMask('c:\users\lagos_official_admin\appdata\roaming\vofer', '*', true);
 DeleteDirectory('c:\users\lagos_official_admin\appdata\roaming\kyubey');
 DeleteDirectory('c:\users\lagos_official_admin\appdata\roaming\winsapsvc');
 DeleteDirectory('c:\users\lagos_official_admin\appdata\roaming\winsnare');
 DeleteDirectory('c:\users\lagos_official_admin\appdata\roaming\browsers');
 DeleteDirectory('c:\progra~2\fixit');
 DeleteDirectory('c:\users\lagos_official_admin\appdata\roaming\forceupdatevof');
 DeleteDirectory('c:\users\lagos_official_admin\appdata\local\filterstart');
 DeleteDirectory('c:\users\lagos_official_admin\appdata\roaming\event monitor');
 DeleteDirectory('c:\users\lagos_official_admin\appdata\roaming\searchay');
 DeleteDirectory('c:\program files (x86)\screenup');
 DeleteDirectory('c:\users\lagos_official_admin\appdata\roaming\vof');
 DeleteDirectory('c:\users\lagos_official_admin\appdata\roaming\vofer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\WinSAPSvc\Parameters','ServiceDll');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\WINSNARE\Parameters','ServiceDll');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\Eventlog\Application\NSSM','EventMessageFile');
 RegKeyIntParamWrite('HKLM', 'SYSTEM\CurrentControlSet\Services\ucdrv', 'Start', 2);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1804', 1);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
ExecuteSysClean;
 ExecuteRepair(9);
 ExecuteWizard('SCU', 2, 3, true);
 CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
RebootWindows(true);
end.

Компьютер перезагрузится.


Файл quarantine.zip из папки с распакованной утилитой AVZ отправьте с помощью этой формы или (если размер архива превышает 8 MB) на этот почтовый ящик: quarantine <at> safezone.cc (замените <at> на @) с указанием ссылки на тему в теме (заголовке) сообщения и с указанием пароля: virus в теле письма.

Удалите параметры запуска ярлыков. Лог, который создается после удаления, прикрепите к сообщению.

Подготовьте лог AdwCleaner.

Подготовьте новый CollectionLog.

[Lagos]

Письмо на почту выслал.
Лог, со сброшенными параметрами ярлыков прикрепляю.
Лог AdwCleaner прикрепляю.
Новый CollectionLog, также, прикрепляю.

[shestale]

1. Удалите в AdwCleaner все найденные объекты. Лог, который создается после удаления, прикрепите к сообщению.

2. Закройте все программы, временно выгрузите антивирус, файрволл и прочее защитное ПО.

Выполните скрипт в АВЗ (Файл - Выполнить скрипт):

Код:

begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
 QuarantineFileF('c:\users\lagos_official_admin\appdata\roaming\kyubey', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\Kyubey\Kyubey.exe', '');
 QuarantineFile('C:\Program Files (x86)\Anipertheratpeph Manager\local64spl.dll', '');
 QuarantineFile('C:\Program Files (x86)\Chermock\xanaqatain.exe','');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\CDManager\updater.py','');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\CDManager\python\pythonw.exe','');
 QuarantineFile('C:\Users\Lagos_official_admin\AppData\Roaming\CDManager\ml.py','');
 QuarantineFile('C:\Program Files (x86)\uqmTDcCiPv\updengine.exe','');
 QuarantineFile('C:\ProgramData\RegisterObject\RegisterObject.exe','');
 QuarantineFile('C:\Update\psgo\psgo.ps1','');
 ExecuteFile('schtasks.exe', '/delete /TN "Anipertheratpeph Manager" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "CDManager2" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "CDManager" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "Windows-PG" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "Greright" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "Greright" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "uqmTDcCiPv" /F', 0, 15000, true);
 DeleteFile('C:\Update\psgo\psgo.ps1','32');
 DeleteFile('C:\ProgramData\RegisterObject\RegisterObject.exe','32');
 DeleteFile('C:\Program Files (x86)\uqmTDcCiPv\updengine.exe','32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\CDManager\ml.py','32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\CDManager\python\pythonw.exe','32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\CDManager\updater.py','32');
 DeleteFile('C:\Program Files (x86)\Chermock\xanaqatain.exe','32');
 DeleteFile('C:\Users\Lagos_official_admin\AppData\Roaming\Kyubey\Kyubey.exe', '32');
 DeleteFile('C:\Program Files (x86)\Anipertheratpeph Manager\local64spl.dll', '32');
 DeleteFileMask('c:\users\lagos_official_admin\appdata\roaming\kyubey', '*', true);
 DeleteDirectory('c:\users\lagos_official_admin\appdata\roaming\kyubey');
 RegKeyIntParamWrite('HKLM', 'SYSTEM\CurrentControlSet\Services\ucdrv', 'Start', 2);
 DeleteService('Kyubey');
ExecuteSysClean;
 ExecuteWizard('SCU', 2, 3, true);
 CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
RebootWindows(true);
end.

Компьютер перезагрузится.

3. Файл quarantine.zip из папки с распакованной утилитой AVZ отправьте с помощью этой формы или (если размер архива превышает 8 MB) на этот почтовый ящик: quarantine <at> safezone.cc (замените <at> на @) с указанием ссылки на тему в теме (заголовке) сообщения и с указанием пароля: virus в теле письма.

4. Подготовьте новый CollectionLog.

5. Подготовьте логи FRST

[Lagos]

Письмо отправил.
Все 5 логов прикрепляю.

[shestale]

Выполните скрипт в Farbar Recovery Scan Tool
Лог, который будет создан после выполнения скрипта, прикрепите к сообщению.

Код:

start
CreateRestorePoint:
AlternateDataStreams: C:\Windows\system32\drivers:ucdrv-x64.sys [25444]
AlternateDataStreams: C:\Windows\system32\drivers:x64 [1498914]
AlternateDataStreams: C:\Windows\system32\drivers:x86 [1223458]
AlternateDataStreams: C:\ProgramData\TEMP:28AE6654 [169]
AlternateDataStreams: C:\Users\Public\DRM:احتضان [48]
AlternateDataStreams: C:\Users\Все пользователи\TEMP:28AE6654 [169]
R1 ucdrv; C:\Windows\System32\drivers:ucdrv-x64.sys [25444 ] (UC Web Inc.) <==== ATTENTION
HKU\S-1-5-18\...\Run: [] => [X]
HKLM\...\Providers\4aem8v9z: C:\Program Files (x86)\Anipertheratpeph Manager\local64spl.dll
GroupPolicy: Restriction - Chrome <======= ATTENTION
GroupPolicy\User: Restriction <======= ATTENTION
GroupPolicyScripts: Restriction <======= ATTENTION
CHR DefaultSearchKeyword: ChromeDefaultData -> youndoo
CHR Profile: C:\Users\Lagos_official_admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-03-29] <==== ATTENTION
CHR Profile: C:\Users\Lagos_official_admin\AppData\Local\Google\Chrome\User Data\Default_bag [2017-03-29] <==== ATTENTION
StartMenuInternet: (HKLM) Operabeta - C:\Program Files (x86)\Opera Next\Launcher.exe hxxp://www.startpageing123.com/?type=sc&ts=1490774628&z=34e7f897ee5784006059bb7g6z3t5ebmam7z0qeobq&from=che0812&uid=ADATAXSP900_7D5120007721
CHR DefaultSearchURL: ChromeDefaultData -> hxxp://www.youndoo.com/search/?q={searchTerms}&z=fe116fe6f3d9194ecff32a3g3z3t0e6q3oetcg8qbt&from=wak&uid=ADATAXSP900_7D5120007721&type=sp
2017-03-28 00:39 - 2017-03-30 14:47 - 00000000 ____D C:\Program Files (x86)\Chermock
2017-03-28 00:39 - 2017-03-28 00:39 - 00000000 ____D C:\Program Files (x86)\MIO
2017-03-27 21:49 - 2017-03-27 21:49 - 02978349 _____ C:\Users\Lagos_official_admin\AppData\Roaming\codecswift.exe
2017-03-27 21:49 - 2017-03-27 21:49 - 0000040 _____ () C:\Users\Lagos_official_admin\AppData\Roaming\CDManager.exe.sha1
2017-03-27 21:49 - 2017-03-27 21:49 - 2978349 _____ () C:\Users\Lagos_official_admin\AppData\Roaming\codecswift.exe
2017-03-27 21:49 - 2017-03-27 21:49 - 0000040 _____ () C:\Users\Lagos_official_admin\AppData\Roaming\codecswift.exe.sha1
2017-03-27 18:41 - 2017-03-27 18:41 - 1156096 _____ () C:\Users\Lagos_official_admin\AppData\Roaming\Transphase.exe
2017-03-27 21:49 - 2017-03-27 22:13 - 0000040 _____ () C:\Users\Lagos_official_admin\AppData\Roaming\vof.exe.sha1
2017-03-27 21:49 - 2017-03-27 21:49 - 0000040 _____ () C:\Users\Lagos_official_admin\AppData\Roaming\WinJar.exe.sha1
2017-03-27 18:41 - 2017-03-27 18:41 - 1156096 _____ () C:\Users\Lagos_official_admin\AppData\Roaming\Xxx-kix.exe
EmptyTemp:
Reboot:
end

Что с проблемами?

Смените пароли.