pluginplus.net/install.php удалить

[Roman Esayan]

По этой ссылке http://www.spyware-ru.com/udalit-pluginplus-net-install-php-reklamu-instruktsiya/. Все сделал как надо adwcleaner и Malwarebytes Anti-malware уже ничего не видет ни вирусов ничего. Но окна в Internet Explorer всплывали. сброс сделал и даже выключил его. Потом как поставил в Opera beta браузер по умолчанию .Снова стало выскакивать окна с pluginplus.net/install.php хотя оперу сносил полностью. Помогите пожалуйста

[Roman Esayan]

Просканировал через FRST.

Вложения:

You must be logged in to view attached files.

[Admin]

Здравствуйте, добро пожаловать на Spyware-ru форум.

Запустите программу Блокнот и вставьте в открытое окно следующий текст

CreateRestorePoint:
HKLM-x32\...\Run: [] => [X]
Toolbar: HKU\S-1-5-21-3788495910-1592582245-2105468030-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
CHR Extension: (Домашняя страница Mail.Ru) - C:\Users\Footwear\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfifbojenkenpkmnbnndeadpfdiffof [2016-06-29]
CHR Extension: (Mail.Ru) - C:\Users\Footwear\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojlcebdkbpjdpiligkdbbkdkfjmchbfd [2016-06-29]
CHR HKLM-x32\...\Chrome\Extension: [ahnphcmhmhcjjcjhmnnjjlbmaeljecga] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ojlcebdkbpjdpiligkdbbkdkfjmchbfd] - hxxps://clients2.google.com/service/update2/crx
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 WinRing0_1_2_0; \??\C:\Users\Footwear\AppData\Local\Temp\tmp9C42.tmp [X]
Task: {12E0CAA9-43A2-423F-874D-AF546B458D18} - System32\Tasks\{09A1C8C3-1ECF-41AA-916D-DE8C84D59D51} => F:\Скорая помощь тесты\TEST.EXE
Task: {1FE48882-D0D0-47F9-88A6-5FB22CA6C456} - System32\Tasks\{A2F9C904-7B53-4EBC-885F-DF091271F92A} => F:\Скорая помощь тесты\TEST.EXE
Task: {21511DF9-C9E2-45C4-A6AD-316E6A681ABC} - System32\Tasks\{A5D3E61C-6DE9-4004-A37C-EF21C080982F} => F:\Скорая помощь тесты\TEST.EXE
Task: {23CD5FBA-8298-428E-897C-65066D59D3F2} - System32\Tasks\{E1FFD0DB-DF24-49EB-BC13-B982E248A101} => F:\Скорая помощь тесты\TEST.EXE
Task: {2E358194-4566-4AE0-9C22-85C34EF4A50B} - System32\Tasks\PCMeter\Startup => C:\Users\Footwear\AppData\Local\Temp\Rar$EXa0.318\PCMeterV4\PCMeterV0.4.exe <==== ATTENTION
Task: {5424045B-2F6F-4AA3-BD4D-23C1E3E993A9} - System32\Tasks\{16B3077E-B6C3-44BE-A29D-A57161A204D3} => F:\Скорая помощь тесты\TEST.EXE
Task: {7199C4F4-798B-4294-963F-335D284D907E} - System32\Tasks\{7F5C91A7-1C49-45C9-8C7C-0F693752B7DE} => pcalua.exe -a C:\Users\Footwear\Desktop\GlazTV-Setup-v1.02.exe -d C:\Users\Footwear\Desktop
Task: {720680AC-EEB1-4D8A-B623-23F5327A17D2} - System32\Tasks\System_service => c:\Temp\System32\start.vbs [2016-06-17] () <==== ATTENTION
Task: {79E4C60B-A4CB-4D33-91D7-155BB7871A2E} - System32\Tasks\{7E96808A-EE03-4824-AD73-07CAC4800BFD} => C:\Program Files (x86)\Glaz.TV\GlazTV.exe [2016-01-09] ()
Task: {8C30422B-7140-430D-B62D-15B8E66CFDFC} - System32\Tasks\{66765A85-5789-4094-B815-35DAC0E10D67} => F:\Скорая помощь тесты\TEST.EXE
Task: {9B6F4635-3666-419A-867E-FD35DABF0E80} - System32\Tasks\{75981E60-D079-4F9A-B786-141266CD03F0} => F:\Скорая помощь тесты\TEST.EXE
Task: {A183C2E6-999E-42B2-979A-6A01D854DDCE} - System32\Tasks\{B49D85E9-DB8B-45F8-8A6D-4F92415E4D42} => F:\Скорая помощь тесты\TEST.EXE
Task: {A4840AC5-54E1-4ED1-A30E-8B9C08B31952} - System32\Tasks\{68877FEB-3DF5-4DE1-A1B9-80A80BE82617} => F:\Скорая помощь тесты\TEST.EXE
Task: {B02D66C8-82AB-4E97-B85D-A2BFDE616381} - System32\Tasks\{AFD750B4-A3E5-4AC7-9C04-68B9EC146CD2} => pcalua.exe -a C:\Users\Footwear\AppData\Local\Temp\DT_INSTALL_TMP\YandexSetup.exe -d "C:\Program Files (x86)\DAEMON Tools Pro" -c --partner dt-pro-elements  --distr /passive /msicl " "
Task: {BEDDE328-4233-4909-8720-03E65EB6E601} - System32\Tasks\{76ADEBCF-F074-4C33-A124-E2440D7B9FB1} => F:\Скорая помощь тесты\TEST.EXE
Task: {C3AC5A19-AAF5-4363-9B1D-5CC70B5180E4} - System32\Tasks\{33E02AE2-65C7-4FCC-9B9C-744CFA8D5928} => F:\Скорая помощь тесты\TEST.EXE
Task: {DCBEDDDB-4C60-400C-A53B-5E9C78C6C607} - System32\Tasks\{EFA0CF60-5FA8-40C1-97E1-FDBFEFA4D5FB} => F:\Скорая помощь тесты\TEST.EXE
Task: {E3482FF7-819A-47FE-A08C-2999E4BF9823} - System32\Tasks\{040975AE-1648-4191-8201-8E4D9F6B6972} => F:\Скорая помощь тесты\TEST.EXE
Task: {F0684BCB-3D4C-4D98-BDBB-D637977AA78B} - System32\Tasks\{26EA4D94-78F1-45FD-AE37-33A4FEA63918} => F:\Скорая помощь тесты\TEST.EXE
Task: {F3C2556B-D12C-4038-B0EA-6B9B75F8F985} - System32\Tasks\System_update => c:\Temp\System32\start.vbs [2016-06-17] () <==== ATTENTION
EmptyTemp:
Reboot:

Сохраните полученный файл в папку где находится программа FRST/FRST64 под именем fixlist

Запустите программу FRST и нажмите кнопку Fix.
Когда программа закончит работу появиться сообщение "Fix completed". Нажмите OK.
Откроется блокнот с содержимым файла fixlog.txt. Вставьте содержимое этого файла в ваш ответ.

После этого выполните новую проверку программой FRST (перед нажатием клавиши Scan поставьте галочку в пункте Addition.txt) и оба её лога прикрепите к вашему ответу.

[Roman Esayan]

Fix result of Farbar Recovery Scan Tool (x64) Version: 02-07-2016
Ran by Footwear (2016-07-04 17:06:24) Run:1
Running from C:\Users\Footwear\Desktop\fixlist
Loaded Profiles: Footwear (Available Profiles: Footwear)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
HKLM-x32\…\Run: [] => [X]
Toolbar: HKU\S-1-5-21-3788495910-1592582245-2105468030-1000 -> No Name — {2318C2B1-4965-11D4-9B18-009027A5CD4F} — No File
CHR Extension: (Домашняя страница Mail.Ru) — C:\Users\Footwear\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfifbojenkenpkmnbnndeadpfdiffof [2016-06-29]
CHR Extension: (Mail.Ru) — C:\Users\Footwear\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojlcebdkbpjdpiligkdbbkdkfjmchbfd [2016-06-29]
CHR HKLM-x32\…\Chrome\Extension: [ahnphcmhmhcjjcjhmnnjjlbmaeljecga] — hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [ojlcebdkbpjdpiligkdbbkdkfjmchbfd] — hxxps://clients2.google.com/service/update2/crx
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 WinRing0_1_2_0; \??\C:\Users\Footwear\AppData\Local\Temp\tmp9C42.tmp [X]
Task: {12E0CAA9-43A2-423F-874D-AF546B458D18} — System32\Tasks\{09A1C8C3-1ECF-41AA-916D-DE8C84D59D51} => F:\Скорая помощь тесты\TEST.EXE
Task: {1FE48882-D0D0-47F9-88A6-5FB22CA6C456} — System32\Tasks\{A2F9C904-7B53-4EBC-885F-DF091271F92A} => F:\Скорая помощь тесты\TEST.EXE
Task: {21511DF9-C9E2-45C4-A6AD-316E6A681ABC} — System32\Tasks\{A5D3E61C-6DE9-4004-A37C-EF21C080982F} => F:\Скорая помощь тесты\TEST.EXE
Task: {23CD5FBA-8298-428E-897C-65066D59D3F2} — System32\Tasks\{E1FFD0DB-DF24-49EB-BC13-B982E248A101} => F:\Скорая помощь тесты\TEST.EXE
Task: {2E358194-4566-4AE0-9C22-85C34EF4A50B} — System32\Tasks\PCMeter\Startup => C:\Users\Footwear\AppData\Local\Temp\Rar$EXa0.318\PCMeterV4\PCMeterV0.4.exe < ==== ATTENTION
Task: {5424045B-2F6F-4AA3-BD4D-23C1E3E993A9} — System32\Tasks\{16B3077E-B6C3-44BE-A29D-A57161A204D3} => F:\Скорая помощь тесты\TEST.EXE
Task: {7199C4F4-798B-4294-963F-335D284D907E} — System32\Tasks\{7F5C91A7-1C49-45C9-8C7C-0F693752B7DE} => pcalua.exe -a C:\Users\Footwear\Desktop\GlazTV-Setup-v1.02.exe -d C:\Users\Footwear\Desktop
Task: {720680AC-EEB1-4D8A-B623-23F5327A17D2} — System32\Tasks\System_service => c:\Temp\System32\start.vbs [2016-06-17] () < ==== ATTENTION
Task: {79E4C60B-A4CB-4D33-91D7-155BB7871A2E} — System32\Tasks\{7E96808A-EE03-4824-AD73-07CAC4800BFD} => C:\Program Files (x86)\Glaz.TV\GlazTV.exe [2016-01-09] ()
Task: {8C30422B-7140-430D-B62D-15B8E66CFDFC} — System32\Tasks\{66765A85-5789-4094-B815-35DAC0E10D67} => F:\Скорая помощь тесты\TEST.EXE
Task: {9B6F4635-3666-419A-867E-FD35DABF0E80} — System32\Tasks\{75981E60-D079-4F9A-B786-141266CD03F0} => F:\Скорая помощь тесты\TEST.EXE
Task: {A183C2E6-999E-42B2-979A-6A01D854DDCE} — System32\Tasks\{B49D85E9-DB8B-45F8-8A6D-4F92415E4D42} => F:\Скорая помощь тесты\TEST.EXE
Task: {A4840AC5-54E1-4ED1-A30E-8B9C08B31952} — System32\Tasks\{68877FEB-3DF5-4DE1-A1B9-80A80BE82617} => F:\Скорая помощь тесты\TEST.EXE
Task: {B02D66C8-82AB-4E97-B85D-A2BFDE616381} — System32\Tasks\{AFD750B4-A3E5-4AC7-9C04-68B9EC146CD2} => pcalua.exe -a C:\Users\Footwear\AppData\Local\Temp\DT_INSTALL_TMP\YandexSetup.exe -d «C:\Program Files (x86)\DAEMON Tools Pro» -c —partner dt-pro-elements —distr /passive /msicl » »
Task: {BEDDE328-4233-4909-8720-03E65EB6E601} — System32\Tasks\{76ADEBCF-F074-4C33-A124-E2440D7B9FB1} => F:\Скорая помощь тесты\TEST.EXE
Task: {C3AC5A19-AAF5-4363-9B1D-5CC70B5180E4} — System32\Tasks\{33E02AE2-65C7-4FCC-9B9C-744CFA8D5928} => F:\Скорая помощь тесты\TEST.EXE
Task: {DCBEDDDB-4C60-400C-A53B-5E9C78C6C607} — System32\Tasks\{EFA0CF60-5FA8-40C1-97E1-FDBFEFA4D5FB} => F:\Скорая помощь тесты\TEST.EXE
Task: {E3482FF7-819A-47FE-A08C-2999E4BF9823} — System32\Tasks\{040975AE-1648-4191-8201-8E4D9F6B6972} => F:\Скорая помощь тесты\TEST.EXE
Task: {F0684BCB-3D4C-4D98-BDBB-D637977AA78B} — System32\Tasks\{26EA4D94-78F1-45FD-AE37-33A4FEA63918} => F:\Скорая помощь тесты\TEST.EXE
Task: {F3C2556B-D12C-4038-B0EA-6B9B75F8F985} — System32\Tasks\System_update => c:\Temp\System32\start.vbs [2016-06-17] () < ==== ATTENTION
EmptyTemp:
Reboot:
*****************

Restore point was successfully created.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
HKU\S-1-5-21-3788495910-1592582245-2105468030-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value removed successfully
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => key not found.
C:\Users\Footwear\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfifbojenkenpkmnbnndeadpfdiffof => moved successfully
C:\Users\Footwear\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojlcebdkbpjdpiligkdbbkdkfjmchbfd => moved successfully
«HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ahnphcmhmhcjjcjhmnnjjlbmaeljecga» => key removed successfully
«HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ojlcebdkbpjdpiligkdbbkdkfjmchbfd» => key removed successfully
MBAMSwissArmy => service removed successfully
VGPU => service removed successfully
WinRing0_1_2_0 => service removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{12E0CAA9-43A2-423F-874D-AF546B458D18}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{12E0CAA9-43A2-423F-874D-AF546B458D18}» => key removed successfully
C:\Windows\System32\Tasks\{09A1C8C3-1ECF-41AA-916D-DE8C84D59D51} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{09A1C8C3-1ECF-41AA-916D-DE8C84D59D51}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1FE48882-D0D0-47F9-88A6-5FB22CA6C456}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1FE48882-D0D0-47F9-88A6-5FB22CA6C456}» => key removed successfully
C:\Windows\System32\Tasks\{A2F9C904-7B53-4EBC-885F-DF091271F92A} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A2F9C904-7B53-4EBC-885F-DF091271F92A}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{21511DF9-C9E2-45C4-A6AD-316E6A681ABC}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{21511DF9-C9E2-45C4-A6AD-316E6A681ABC}» => key removed successfully
C:\Windows\System32\Tasks\{A5D3E61C-6DE9-4004-A37C-EF21C080982F} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A5D3E61C-6DE9-4004-A37C-EF21C080982F}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{23CD5FBA-8298-428E-897C-65066D59D3F2}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{23CD5FBA-8298-428E-897C-65066D59D3F2}» => key removed successfully
C:\Windows\System32\Tasks\{E1FFD0DB-DF24-49EB-BC13-B982E248A101} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{E1FFD0DB-DF24-49EB-BC13-B982E248A101}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{2E358194-4566-4AE0-9C22-85C34EF4A50B}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2E358194-4566-4AE0-9C22-85C34EF4A50B}» => key removed successfully
C:\Windows\System32\Tasks\PCMeter\Startup => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PCMeter\Startup» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5424045B-2F6F-4AA3-BD4D-23C1E3E993A9}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5424045B-2F6F-4AA3-BD4D-23C1E3E993A9}» => key removed successfully
C:\Windows\System32\Tasks\{16B3077E-B6C3-44BE-A29D-A57161A204D3} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{16B3077E-B6C3-44BE-A29D-A57161A204D3}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7199C4F4-798B-4294-963F-335D284D907E}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7199C4F4-798B-4294-963F-335D284D907E}» => key removed successfully
C:\Windows\System32\Tasks\{7F5C91A7-1C49-45C9-8C7C-0F693752B7DE} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{7F5C91A7-1C49-45C9-8C7C-0F693752B7DE}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{720680AC-EEB1-4D8A-B623-23F5327A17D2}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{720680AC-EEB1-4D8A-B623-23F5327A17D2}» => key removed successfully
C:\Windows\System32\Tasks\System_service => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\System_service» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{79E4C60B-A4CB-4D33-91D7-155BB7871A2E}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{79E4C60B-A4CB-4D33-91D7-155BB7871A2E}» => key removed successfully
C:\Windows\System32\Tasks\{7E96808A-EE03-4824-AD73-07CAC4800BFD} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{7E96808A-EE03-4824-AD73-07CAC4800BFD}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8C30422B-7140-430D-B62D-15B8E66CFDFC}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8C30422B-7140-430D-B62D-15B8E66CFDFC}» => key removed successfully
C:\Windows\System32\Tasks\{66765A85-5789-4094-B815-35DAC0E10D67} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{66765A85-5789-4094-B815-35DAC0E10D67}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9B6F4635-3666-419A-867E-FD35DABF0E80}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9B6F4635-3666-419A-867E-FD35DABF0E80}» => key removed successfully
C:\Windows\System32\Tasks\{75981E60-D079-4F9A-B786-141266CD03F0} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{75981E60-D079-4F9A-B786-141266CD03F0}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A183C2E6-999E-42B2-979A-6A01D854DDCE}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A183C2E6-999E-42B2-979A-6A01D854DDCE}» => key removed successfully
C:\Windows\System32\Tasks\{B49D85E9-DB8B-45F8-8A6D-4F92415E4D42} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{B49D85E9-DB8B-45F8-8A6D-4F92415E4D42}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A4840AC5-54E1-4ED1-A30E-8B9C08B31952}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4840AC5-54E1-4ED1-A30E-8B9C08B31952}» => key removed successfully
C:\Windows\System32\Tasks\{68877FEB-3DF5-4DE1-A1B9-80A80BE82617} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{68877FEB-3DF5-4DE1-A1B9-80A80BE82617}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B02D66C8-82AB-4E97-B85D-A2BFDE616381}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B02D66C8-82AB-4E97-B85D-A2BFDE616381}» => key removed successfully
C:\Windows\System32\Tasks\{AFD750B4-A3E5-4AC7-9C04-68B9EC146CD2} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{AFD750B4-A3E5-4AC7-9C04-68B9EC146CD2}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BEDDE328-4233-4909-8720-03E65EB6E601}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BEDDE328-4233-4909-8720-03E65EB6E601}» => key removed successfully
C:\Windows\System32\Tasks\{76ADEBCF-F074-4C33-A124-E2440D7B9FB1} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{76ADEBCF-F074-4C33-A124-E2440D7B9FB1}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C3AC5A19-AAF5-4363-9B1D-5CC70B5180E4}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C3AC5A19-AAF5-4363-9B1D-5CC70B5180E4}» => key removed successfully
C:\Windows\System32\Tasks\{33E02AE2-65C7-4FCC-9B9C-744CFA8D5928} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{33E02AE2-65C7-4FCC-9B9C-744CFA8D5928}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DCBEDDDB-4C60-400C-A53B-5E9C78C6C607}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DCBEDDDB-4C60-400C-A53B-5E9C78C6C607}» => key removed successfully
C:\Windows\System32\Tasks\{EFA0CF60-5FA8-40C1-97E1-FDBFEFA4D5FB} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{EFA0CF60-5FA8-40C1-97E1-FDBFEFA4D5FB}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E3482FF7-819A-47FE-A08C-2999E4BF9823}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E3482FF7-819A-47FE-A08C-2999E4BF9823}» => key removed successfully
C:\Windows\System32\Tasks\{040975AE-1648-4191-8201-8E4D9F6B6972} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{040975AE-1648-4191-8201-8E4D9F6B6972}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F0684BCB-3D4C-4D98-BDBB-D637977AA78B}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F0684BCB-3D4C-4D98-BDBB-D637977AA78B}» => key removed successfully
C:\Windows\System32\Tasks\{26EA4D94-78F1-45FD-AE37-33A4FEA63918} => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{26EA4D94-78F1-45FD-AE37-33A4FEA63918}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F3C2556B-D12C-4038-B0EA-6B9B75F8F985}» => key removed successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F3C2556B-D12C-4038-B0EA-6B9B75F8F985}» => key removed successfully
C:\Windows\System32\Tasks\System_update => moved successfully
«HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\System_update» => key removed successfully

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 5600535 B
Java, Flash, Steam htmlcache => 506 B
Windows/system/drivers => 308063 B
Edge => 0 B
Chrome => 22528 B
Firefox => 0 B
Opera => 12984768 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 18621 B
systemprofile32 => 66228 B
LocalService => 132244 B
NetworkService => 692 B
Footwear => 239221 B

RecycleBin => 544 B
EmptyTemp: => 26.5 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 17:06:37 ====

[Roman Esayan]

Все сделал.

Вложения:

You must be logged in to view attached files.

[Admin]

Запустите программу Блокнот и вставьте в открытое окно следующий текст

CreateRestorePoint:
CHR HKLM-x32\...\Chrome\Extension: [ccfifbojenkenpkmnbnndeadpfdiffof] - hxxps://clients2.google.com/service/update2/crx
EmptyTemp:
Reboot:

Сохраните полученный файл в папку где находится программа FRST/FRST64 под именем fixlist

Запустите программу FRST и нажмите кнопку Fix.
Когда программа закончит работу появиться сообщение «Fix completed». Нажмите OK.
Откроется блокнот с содержимым файла fixlog.txt. Вставьте содержимое этого файла в ваш ответ.

После этого выполните новую проверку программой FRST (перед нажатием клавиши Scan поставьте галочку в пункте Addition.txt) и оба её лога прикрепите к вашему ответу.

И ещё, окна с pluginplus.net/install.php выскакивают ?

[Roman Esayan]

Спасибо огромное, больше не выскакивает!

[Roman Esayan]

Fix result of Farbar Recovery Scan Tool (x64) Version: 02-07-2016
Ran by Footwear (2016-07-06 20:05:23) Run:2
Running from C:\Users\Footwear\Desktop\Временная\fixlist
Loaded Profiles: Footwear (Available Profiles: Footwear)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
CHR HKLM-x32\…\Chrome\Extension: [ccfifbojenkenpkmnbnndeadpfdiffof] — hxxps://clients2.google.com/service/update2/crx
EmptyTemp:
Reboot:
*****************

Restore point was successfully created.
«HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ccfifbojenkenpkmnbnndeadpfdiffof» => key removed successfully

=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 74876345 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 567983 B
Edge => 0 B
Chrome => 0 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 692 B
systemprofile32 => 66228 B
LocalService => 132244 B
NetworkService => 692 B
Footwear => 39356902 B

RecycleBin => 60462 B
EmptyTemp: => 109.7 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 20:05:36 ====

[Roman Esayan]

Спасибо все супер =)

Вложения:

You must be logged in to view attached files.

[Admin]

Логи нормальные.

Похоже что у вас сейчас нет антивирусной программы. Прочитайте эту статью, в её нижней части есть ссылки на бесплатные антивирусы, выберите один из них и установить на компьютер.

Рад был вам помочь, всего доброго.

[Roman Esayan]

Спасибо Огромное ! Буду вдруг что, вас рекламировать и советовать.Спасибо за совет.

[Автор]

Сообщения