Fix result of Farbar Recovery Scan Tool (x86) Version: 31-08-2016 Ran by User (08-09-2016 07:52:22) Run:1 Running from C:\Users\User\Downloads Loaded Profiles: User (Available Profiles: User & DefaultAppPool) Boot Mode: Normal ============================================== fixlist content: ***************** CreateRestorePoint: Tcpip\..\Interfaces\{9ea3a412-ef40-4b1a-b990-82ea98d5cce8}: [NameServer] 91.109.206.194 Tcpip\..\Interfaces\{a40a112a-8b40-4471-bbac-b58b05fe0b50}: [NameServer] 98.158.96.96 Tcpip\..\Interfaces\{f0eb8250-86c6-4c43-a45d-c014b090994d}: [NameServer] 98.158.96.96 HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction < ======= ATTENTION CHR HKLM\…\Chrome\Extension: [oelpkepjlgmehajehfeicfbjdiobdkfj] — hxxps://clients2.google.com/service/update2/crx

Fix result of Farbar Recovery Scan Tool (x64) Version: 31-08-2016 Ran by Veon (01-09-2016 23:48:53) Run:4 Running from C:\Users\Veon\Desktop\Новая папка (2) Loaded Profiles: Veon (Available Profiles: Veon) Boot Mode: Normal ============================================== fixlist content: ***************** CreateRestorePoint: CHR HomePage: Default -> hxxp://www.istartsurf.com/?type=hp&ts=1434984088&z=73decd2cb7a375c731b0cb3g7z6caz5teb0z1e5b6b&from=cor&uid=ST31500341AS_9VS4EYGVXXXX9VS4EYGV EmptyTemp: Reboot: ***************** Restore point was successfully created. Chrome HomePage => removed successfully =========== EmptyTemp:

Fix result of Farbar Recovery Scan Tool (x64) Version: 28-08-2016 Ran by Veon (29-08-2016 22:05:21) Run:3 Running from C:\Users\Veon\Desktop\Новая папка (2) Loaded Profiles: Veon (Available Profiles: Veon) Boot Mode: Normal ============================================== fixlist content: ***************** CreateRestorePoint: HKU\S-1-5-21-2847065280-533247320-1110104380-1000\…\Run: [Veon] => explorer.exe hxxp://sd-steam.info < ===== ATTENTION CHR HomePage: Default -> hxxp://www.istartsurf.com/?type=hp&ts=1434984088&z=73decd2cb7a375c731b0cb3g7z6caz5teb0z1e5b6b&from=cor&uid=ST31500341AS_9VS4EYGVXXXX9VS4EYGV CHR StartupUrls: Default -> «hxxp://ru.topsites.me/»,»hxxp://www.istartsurf.com/?type=hp&ts=1434984088&z=73decd2cb7a375c731b0cb3g7z6caz5teb0z1e5b6b&from=cor&uid=ST31500341AS_9VS4EYGVXXXX9VS4EYGV» CHR HKLM\…\Chrome\Extension:

Fix result of Farbar Recovery Scan Tool (x64) Version: 21-08-2016 01 Ran by Rizat (26-08-2016 16:29:29) Run:3 Running from C:\Users\Rizat\Downloads Loaded Profiles: Rizat (Available Profiles: Rizat & Администратор) Boot Mode: Normal ============================================== fixlist content: ***************** CreateRestorePoint: GroupPolicyScripts: Restriction < ======= ATTENTION FF Homepage: hxxp://tmutara.ru/?utm_content=49f4c593a4d99a0a30351a0448198d82&utm_source=startpm&utm_term=6B1CC39B212BFFC5CF9F18CE7540FC79&utm_d=20160816 CHR HomePage: Default -> hxxp://tmutara.ru/?utm_content=49f4c593a4d99a0a30351a0448198d82&utm_source=startpm&utm_term=6B1CC39B212BFFC5CF9F18CE7540FC79&utm_d=20160816 CHR StartupUrls: Default -> «hxxp://tmutara.ru/?utm_content=49f4c593a4d99a0a30351a0448198d82&utm_source=startpm&utm_term=6B1CC39B212BFFC5CF9F18CE7540FC79&utm_d=2016081 Task:

C:\Users\Rizat\Downloads\jxpiinstall.exe => «:$CmdZnID» ADS removed successfully. «C:\Users\Rizat\Downloads\mbam-clean-2.3.0.1001.exe» => «:$CmdTcID» ADS not found. C:\Users\Rizat\Downloads\mbam-clean-2.3.0.1001.exe => «:$CmdZnID» ADS removed successfully. «C:\Users\Rizat\Downloads\mbam-setup-2.2.1.1043(1).exe» => «:$CmdTcID» ADS not found. C:\Users\Rizat\Downloads\mbam-setup-2.2.1.1043(1).exe => «:$CmdZnID» ADS removed successfully. «C:\Users\Rizat\Downloads\MultiPackFull.exe» => «:$CmdTcID» ADS not found. C:\Users\Rizat\Downloads\MultiPackFull.exe => «:$CmdZnID» ADS removed successfully. C:\Users\Rizat\Downloads\preview (1).mp3 => «:$CmdZnID» ADS removed successfully. C:\Users\Rizat\Downloads\preview.mp3 => «:$CmdZnID» ADS removed successfully.

Fix result of Farbar Recovery Scan Tool (x64) Version: 21-08-2016 Ran by Руслан (21-08-2016 13:32:44) Run:2 Running from C:\Users\Руслан\ЗАГРУЗКА Loaded Profiles: Руслан (Available Profiles: Руслан) Boot Mode: Normal ============================================== fixlist content: ***************** CreateRestorePoint: HKLM-x32\…\Run: [UpdReg] => C:\Windows\UpdReg.EXE ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File CHR HomePage: Default -> hxxp://www.search.ask.com/?o=APN11459&gct=hp&d=488-128&v=n12521-404&t=4 CHR HKLM\…\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] — hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka CHR

Содержимое от fixlog: Restore point was successfully created. HKU\S-1-5-21-634344993-332112169-917281006-1000\Software\Microsoft\Windows\CurrentVersion\Run\\?>;L7>20B5;L => value not found. HKU\S-1-5-21-634344993-332112169-917281006-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{91397D20-1446-11D4-8AF4-0040CA1127B6} => value removed successfully HKCR\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6} => key not found. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => value restored successfully Firefox «homepage» removed successfully C:\Users\пользователь\AppData\Roaming\Mozilla\Firefox\Profiles\IVIGxEL2.default\extensions\abs@avira.com => path removed successfully C:\Users\пользователь\AppData\Roaming\Mozilla\Firefox\Profiles\IVIGxEL2.default\Extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7} => moved successfully C:\Users\пользователь\AppData\Roaming\Mozilla\Firefox\Profiles\IVIGxEL2.default\Extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7} => path removed successfully C:\Users\пользователь\AppData\Roaming\Mozilla\Extensions\jid1-n5ARdBzHkUEdAA@jetpack => moved successfully C:\Users\пользователь\AppData\Roaming\Mozilla\Firefox\Profiles\IVIGxEL2.default\Extensions\abs@avira.com => moved successfully

Fix result of Farbar Recovery Scan Tool (x64) Version: 14-08-2016 Ran by Павел (15-08-2016 15:33:42) Run:2 Running from C:\Users\Павел\Downloads Loaded Profiles: Павел (Available Profiles: Павел) Boot Mode: Normal ============================================== fixlist content: ***************** CreateRestorePoint: HKU\S-1-5-21-1380383141-2180828607-1249965073-1000\…\Run: [dvybjwmltv] => explorer «hxxp:///?utm_source=uoua03n&utm_content=fb6126710f9bba594f41bdb6ec9cb56c&utm_term=CC8649800D7A10D0BD2EE7289826E7FB&utm_d=20160506» < ===== ATTENTION HKU\S-1-5-21-1380383141-2180828607-1249965073-1000\…\MountPoints2: {f3dd2e01-0ba9-11e6-b2e6-e8039a87032b} — G:\start.exe HKU\S-1-5-21-1380383141-2180828607-1249965073-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp:///?utm_content=6e4b41f14ac7c0f063d4eb16c0684d3d&utm_source=startpm&utm_term=CC8649800D7A10D0BD2EE7289826E7FB&utm_d=20160506 SearchScopes: HKU\S-1-5-21-1380383141-2180828607-1249965073-1000 -> DefaultScope {A06ED961-D98F-4CF9-A89B-80AB11DB149C}

Спасибо Вам большое! Fixlog: Fix result of Farbar Recovery Scan Tool (x64) Version: 27-07-2016 Ran by n7128_000 (2016-08-01 10:36:11) Run:1 Running from C:\Users\n7128_000\Downloads Loaded Profiles: n7128_000 (Available Profiles: n7128_000) Boot Mode: Normal ============================================== fixlist content: ***************** CreateRestorePoint: HKU\S-1-5-21-2159381935-2003465307-2861899980-1001\…\Run: [QIP Internet Guardian] => C:\Users\n7128_000\AppData\Roaming\QipGuard\QipGuard.exe [436720 2014-11-24] (QIP.ru) HKU\S-1-5-21-2159381935-2003465307-2861899980-1001\…\Run: [EEDSpeedLauncher] => rundll32.exe C:\WINDOWS\system32\eed_ec.dll,SpeedLauncher HKU\S-1-5-21-2159381935-2003465307-2861899980-1001\…\Run: [Power2GoExpress] => NA