Проверьте пожалуйста

[Батаева]

Доброго дня! Проверьте пожалуйста, поймали Spora.Прошлась по сети, вычистила все, можно посмотреть лог файлы, осталось еще что нибудь или нет.

FRST.txt

Addition.txt

[SQ]

Порядок оформления запроса о помощи

 

Касаемо приложенных логов FRST.

• Закройте и сохраните все открытые приложения.
• Скопируйте приведенный ниже текст в Блокнот и сохраните файл как fixlist.txt в ту же папку откуда была запущена утилита Farbar Recovery Scan Tool:

  CreateRestorePoint:
  CloseProcesses:
  HKLM\...\Run: [] => [X]
  CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
  CHR HKU\S-1-5-21-3443611449-2964540119-3293674539-1111\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
  HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
  Toolbar: HKLM - No Name - {91397D20-1446-11D4-8AF4-0040CA1127B6} -  No File
  Toolbar: HKU\.DEFAULT -> No Name - {91397D20-1446-11D4-8AF4-0040CA1127B6} -  No File
  CHR Extension: (No Name) - C:\Users\ksanka.VRPM\AppData\Local\Google\Chrome\User Data\DFLTUSER\Extensions\bhnpmdabjgpimmnbmhefncbghknfegog [2015-10-14]
  CHR Extension: (No Name) - C:\Users\ksanka.VRPM\AppData\Local\Google\Chrome\User Data\DFLTUSER\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-05]
  CHR Extension: (No Name) - C:\Users\ksanka.VRPM\AppData\Local\Google\Chrome\User Data\DFLTUSER\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-03-30]
  CHR HKLM\...\Chrome\Extension: [iapdadaeaebaoigieglfababneoaifnf] - hxxps://clients2.google.com/service/update2/crx
  CHR HKLM\...\Chrome\Extension: [lejgaailkdamkibfiedjjnejcibjgljl] - hxxps://clients2.google.com/service/update2/crx
  CHR HKLM\...\Chrome\Extension: [nldekieodmkceimbjnaboonipiaakoel] - hxxps://clients2.google.com/service/update2/crx
  CHR HKLM\...\Chrome\Extension: [pleoihkpdomoijdpaibdciidfoeedamm] - hxxps://clients2.google.com/service/update2/crx
  2016-08-22 14:32 - 2016-08-22 14:32 - 0000001 _RHOT () C:\Program Files\Conduit
  2016-08-22 14:32 - 2016-08-22 14:32 - 0000001 _RHOT () C:\Program Files\Kinoroom Browser
  2011-06-19 17:21 - 2011-06-19 17:21 - 0011264 _____ () C:\Program Files\multiunwr.exe
  2016-08-22 14:32 - 2016-08-22 14:32 - 0000001 _RHOT () C:\Program Files\Twilight Tech
  2014-10-31 09:42 - 2014-10-31 09:42 - 0000040 _____ () C:\Program Files\{AACE8122-B27D-421C-A5BB-95060941AFD7}.sys
  2015-01-15 08:14 - 2015-10-14 08:03 - 0000000 _____ () C:\Users\ksanka.VRPM\AppData\Roaming\smw_inst
  2016-08-22 14:32 - 2016-08-22 14:32 - 0000001 _RHOT () C:\Users\ksanka.VRPM\AppData\Local\Kometa
  File: C:\Program Files\aih10.exe
  File: C:\Program Files\Alawar KeyGen 3.exe
  File: C:\Program Files\Alawar(Cwer).exe
  File: C:\Program Files\Alawar.exe
  File: C:\Program Files\alsms.exe
  2016-08-22 14:31 - 2016-08-22 14:31 - 0000001 _RHOT () C:\ProgramData\DesktopIcons
  2016-01-27 14:24 - 2016-01-27 14:24 - 0004107 _____ () C:\ProgramData\ejkgirqd.cww
  2016-02-25 13:08 - 2016-02-25 13:08 - 0000016 _____ () C:\ProgramData\mntemp
  2016-01-27 14:41 - 2016-01-27 14:41 - 0004147 _____ () C:\ProgramData\rugqgaaw.ekm
  2016-02-25 13:08 - 2016-02-25 13:08 - 0004881 _____ () C:\ProgramData\rxsmznjf.zcp
  2016-02-02 08:37 - 2016-02-02 08:37 - 0005113 _____ () C:\ProgramData\yexlswff.shb
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{0000002F-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{0002E005-0000-0000-C000-000000000046}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{0BE35204-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\ksanka.VRPM\AppData\Local\Google\Update\1.3.27.5\psuser.dll => No File
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{46763EE0-CAB2-11CE-8C20-00AA0051E5D4}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\ksanka.VRPM\AppData\Local\Google\Update\1.3.28.1\psuser.dll => No File
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE33-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE34-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE35-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE39-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE3C-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE3D-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\ksanka.VRPM\AppData\Local\Google\Update\1.3.26.9\psuser.dll => No File
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\ksanka.VRPM\AppData\Local\Google\Update\1.3.29.1\psuser.dll => No File
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\ksanka.VRPM\AppData\Local\Google\Update\1.3.28.15\psuser.dll => No File
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  CustomCLSID: HKU\S-1-5-21-3443611449-2964540119-3293674539-1111_Classes\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\InprocServer32 -> no filepath
  Task: {0D9B5D92-3A22-486D-A887-3AA21597CF27} - \Microsoft\Windows\Time Synchronization\SynchronizeTime -> No File <==== ATTENTION
  Task: {56DB3D8E-A29B-4CA8-A567-7157BC19BD8F} - System32\Tasks\Kbupdater Utility => C:\ProgramData\Kbupdater Utility\kbupdater-utility.exe [2014-10-09] ()
  Task: {6AEF0C98-2CB4-4B67-8C70-4C977C7355CC} - \Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
  File: c:\windows\core.exe
  Task: {CD2C9B68-8198-4885-8D5C-B9DB84399AF4} - \UpnCH -> No File <==== ATTENTION
  AlternateDataStreams: C:\ProgramData\TEMP:1A15E356 [216]
  AlternateDataStreams: C:\ProgramData\TEMP:2D6D1D25 [252]
  AlternateDataStreams: C:\ProgramData\TEMP:5C353220 [136]
  AlternateDataStreams: C:\ProgramData\TEMP:5F59E8EA [159]
  AlternateDataStreams: C:\ProgramData\TEMP:638A134E [127]
  AlternateDataStreams: C:\ProgramData\TEMP:6A0A47E7 [126]
  AlternateDataStreams: C:\ProgramData\TEMP:6C3B8FB5 [370]
  AlternateDataStreams: C:\ProgramData\TEMP:7B9BB187 [146]
  AlternateDataStreams: C:\ProgramData\TEMP:87A3A233 [179]
  AlternateDataStreams: C:\ProgramData\TEMP:890CC2F3 [127]
  AlternateDataStreams: C:\ProgramData\TEMP:8A0EFC75 [138]
  AlternateDataStreams: C:\ProgramData\TEMP:8E5EA40F [382]
  AlternateDataStreams: C:\ProgramData\TEMP:A31FAD21 [178]
  AlternateDataStreams: C:\ProgramData\TEMP:C0E4282C [117]
  AlternateDataStreams: C:\Users\Все пользователи\TEMP:1A15E356 [216]
  AlternateDataStreams: C:\Users\Все пользователи\TEMP:2D6D1D25 [252]
  AlternateDataStreams: C:\Users\Все пользователи\TEMP:5C353220 [136]
  AlternateDataStreams: C:\Users\Все пользователи\TEMP:5F59E8EA [159]
  AlternateDataStreams: C:\Users\Все пользователи\TEMP:638A134E [127]
  AlternateDataStreams: C:\Users\Все пользователи\TEMP:6A0A47E7 [126]
  AlternateDataStreams: C:\Users\Все пользователи\TEMP:6C3B8FB5 [370]
  AlternateDataStreams: C:\Users\Все пользователи\TEMP:7B9BB187 [146]
  AlternateDataStreams: C:\Users\Все пользователи\TEMP:87A3A233 [179]
  AlternateDataStreams: C:\Users\Все пользователи\TEMP:890CC2F3 [127]
  AlternateDataStreams: C:\Users\Все пользователи\TEMP:8A0EFC75 [138]
  AlternateDataStreams: C:\Users\Все пользователи\TEMP:8E5EA40F [382]
  AlternateDataStreams: C:\Users\Все пользователи\TEMP:A31FAD21 [178]
  AlternateDataStreams: C:\Users\Все пользователи\TEMP:C0E4282C [117]
  AlternateDataStreams: C:\Users\Оксана\Local Settings:wa [146]
  AlternateDataStreams: C:\Users\Оксана\AppData\Local:wa [146]
  AlternateDataStreams: C:\Users\Оксана\AppData\Local\Application Data:wa [146]
  Reboot:
  

• Запустите FRST и нажмите один раз на кнопку Fix и подождите.
• Программа создаст лог-файл (Fixlog.txt). Пожалуйста, прикрепите его в следующем сообщении!
• Обратите внимание, что компьютер будет перезагружен.