[QUOTE]santy написал:
могут предоставить больше информации по актуальной угрозе.[/QUOTE]

Судя по снимку директории сам файл может быть "чистым" просто запускает майнер из директории и дальше он сам...

Есть бесплатная программа для защиты банковской оплаты:  comss.ru/page.php?id=4766

Можно установить ESET Online Scanner
Из антивирусов поддержка XP должна быть у : Comodo и 360 Total Security

[QUOTE]santy написал:
можешь сам зарегистрироваться там[/QUOTE]
Реальной помощи по лечению я там не вижу.
Одни советы и рекомендации по работе со сканерами.
Если бы они сами были заинтересованы в нашем присутствии на форуме...
и как-то стимулировали :)
На большинстве A.V. форумов от вендеров поддержка липовая.

Пока больше всего обнаружений от ESET  ( судя по результатам поиска )

Каталог с животным на снимке.
freesafety.ru/%D0%BE%D1%88%D0%B8%D0%B1%D0%BA%D0%B0-%D0%BF%D1%80%D0%B8-%D0%B7%D0%B0%D0%BF%D1%83%D1%81%D0%BA%D0%B5-c-users-appdata-roaming-microsoft-admodnetw4b8-adnekmod8b4-dll/

[QUOTE]santy написал:
откуда скриншот?[/QUOTE]

Это не сильно интересно ;)
Больше для статистики.
Там и про нас пишут :)
https://otvet.mail.ru/question/223144892

Портрет героя для благодарных потомок в :)
Или к чему приводит самолечение.

Скопируйте приведенный ниже текст в Блокнот и сохраните файл как fixlist.txt в ту же папку откуда была запущена утилита Farbar Recovery Scan Tool:
...
Запустите FRST и нажмите один раз на кнопку Fix и подождите.

[code]

AlternateDataStreams: C:\ProgramData\TEMP:A1EDB939 [132]
AlternateDataStreams: C:\Users\Все пользователи\TEMP:A1EDB939 [132]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-4157911900-1696094767-1380536065-1000\...\Run: [Clownfish] => [X]
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {3D7A54BA-ABC7-4031-8BCE-3BD9B29E6838} - \{BF7EEC91-39C5-4DF6-8A89-7EDA2D253C10} -> No File <==== ATTENTION
Task: {3FC2EEB5-BB53-4324-A3D6-39D90B84B0B2} - no filepath
Task: {60AF8528-98CF-4128-BECB-A884970D14BF} - \SidebarExecute -> No File <==== ATTENTION
Task: {64A2575B-B075-44F0-AEDD-4FE6B438568C} - \Microsoft\Windows\Media Center\PvrScheduleTask -> No File <==== ATTENTION
Task: {7E08025A-B290-4423-A1F4-84517F8CDC47} - \Microsoft\Windows\Media Center\SqlLiteRecoveryTask -> No File <==== ATTENTION
Task: {907E4247-2645-4887-B620-536B5023DEDA} - \Kerish Doctor -> No File <==== ATTENTION
Task: {938F943C-D047-430D-B86E-E5254CC69F38} - \zAmigoBrowserUpdate -> No File <==== ATTENTION
Task: {C3DF0C0C-9DB0-4828-896E-55FCA1454970} - \Microsoft\Windows\Media Center\ObjectStoreRecoveryTask -> No File <==== ATTENTION
Task: {EE9582F1-97E6-49E4-8FD3-8BF1B8F4DBD8} - no filepath
Task: {FC2EE9C7-FDF8-4217-9D9E-BED1154E032F} - \Microsoft\Windows\Media Center\MediaCenterRecoveryTask -> No File <==== ATTENTION
FF Plugin-x32: @adobe.com/AuthorwarePlayer -> C:\Windows\system32\Macromed\AUTHORWA\np32asw.dll [No File]
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1200112.dll [No File]


EmptyTemp:
Reboot:

[/code]
Программа FRST создаст лог-файл (Fixlog.txt). Пожалуйста, прикрепите его в следующем сообщении!

Оцениваем результат.

Олег Летуновский


Скопируйте текст КОДа - в буфер обмена.
uVS: start.exe, текущий пользователь, меню, скрипты - выполнить скрипт из буфера обмена.
ПЕРЕД ВЫПОЛНЕНИЕМ СКРИПТА, ЗАКРЫТЬ БРАУЗЕРЫ!
ВНИМАНИЕ : По окончанию выполнения скрипта компьютер выполнит перезагрузку !


<code>

;uVS v4.11 [http://dsrt.dyndns.org:8888]
;Target OS: NTv6.1
v400c
OFFSGNSAVE
zoo %SystemDrive%\USERS\ОЛЕГ\APPDATA\ROAMING\MICROSOFT\ADMODNETW­4B8\ADNEKMOD8B4.DLL
czoo
regt 18
regt 25
regt 26
regt 38
;------------------------autoscript---------------------------

deldirex %SystemDrive%\USERS\ОЛЕГ\APPDATA\LOCALLOW\UNITY\WEBPLAYER\LO­ADER

deldirex %SystemDrive%\USERS\АДМИНИСТРАТОР\APPDATA\LOCALLOW\UNITY\WEB­PLAYER\LOADER

deldirex %SystemDrive%\PROGRAM FILES (X86)\CROSSBROWSE\CROSSBROWSE\APPLICATION

deldirex %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC

deldirex %SystemDrive%\USERS\ОЛЕГ\APPDATA\LOCAL\YANDEX\BROWSERMANAGER­

deldirex %SystemDrive%\USERS\ОЛЕГ\APPDATA\LOCAL\AMIGO\APPLICATION

deldirex %SystemDrive%\PROGRAM FILES (X86)\PICEXA

delall %SystemDrive%\USERS\ОЛЕГ\APPDATA\ROAMING\MICROSOFT\ADMODNETW­4B8\ADNEKMOD8B4.DLL
delref %SystemDrive%\USERS\����\APPDATA\ROAMING\3ZGPNX83XCOWUSSK12FFUGHLPP.EXE
del %SystemDrive%\USERS\����\APPDATA\ROAMING\3ZGPNX83XCOWUSSK12FFUGHLPP.EXE
delref %SystemDrive%\USERS\ОЛЕГ\APPDATA\LOCAL\MAIL.RU\SPUTNIK\IESEARCHPLUGIN.DLL
del %SystemDrive%\USERS\ОЛЕГ\APPDATA\LOCAL\MAIL.RU\SPUTNIK\IESEARCHPLUGIN.DLL
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBHJCGOMKANPKPBLOKEBECKNHAHGKCMOO%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBPGANGMFFJCOFIKNIBCMFJIONICOHFGJ%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DEHFJIHAHBPHDPLJPIADBKMGMHNFEHHGI%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DFDJDJKKJOIOMAFNIHNOBKINNFJNNLHDG%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DFHKBFKKOHCDGPCKFFAKHBLLIFKAKIHMH%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DNECFMKPLPMINFJAGBLFABGGOMDPAAKAN%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DODIJCGAFKHPOBJLNFDGIACPDENPMBGME%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DOELPKEPJLGMEHAJEHFEICFBJDIOBDKFJ%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DPCHFCKKCCLDKBCLGDEPKAONAMKIGNANH%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DPJFKGJLNOCFAKOHEOAPICNKNOGLIPAPD%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTP://WWW.OURSURFING.COM/WEB/?TYPE=DS&TS=1433113038&Z=2A4EA66BB19477B6D1A1B88G4Z6CCC6G6G6C­4E8CAM&FROM=CMI&UID=WDCXWD10EZEX-08M2NA0_WD-WCC3F7HFSS53FSS53&Q={SEARCHTERMS}
delref HTTP://V9.COM/WEB?TYPE=DS&TS=1450258713&FROM=ZZGBKK123&UID=WDCXWD10EZEX-08M2NA0_WD-WCC3F7HFSS53FSS53&Z=2425B2F1F1280CD50E4E7FCGBZ0WFECO6WEB4M4G­EZ&Q={SEARCHTERMS}
delref HTTP://WWW.ISTARTSURF.COM/?TYPE=HPPP&TS=1438164770&FROM=XTAB&UID=WDCXWD10EZEX-08M2NA0_WD-WCC3F7HFSS53FSS53
delref HTTP://YOURSITES123.COM/WEB?TYPE=DS&TS=1452231014&Z=5AE206B8F9479920AA79B8FG2Z1W1OAO4CAG­7E4G4B&FROM=WPM01073&UID=WDCXWD10EZEX-08M2NA0_WD-WCC3F7HFSS53FSS53&Q={SEARCHTERMS}
delref HTTP://WWW.GOOGLE.RU/SEARCH?HL=RU&Q={SEARCHTERMS}&BTNG=%D0%9F%D0%BE%D0%B8%D1%81%D0%BA+%D0%B2+GOOGLE&LR=
delref HTTP://OVGORSKIY.RU
delall %SystemDrive%\PROGRAMDATA\NEXTRP\COMMON\TEMP\FAIRPLAYKD.SYS
delall %SystemDrive%\USERS\08A4~1\APPDATA\LOCAL\TEMP\CMDLINEEXT03.DLL
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DDDADGCDMDDLJMPKPINKALNEPDEPPLPKJ%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DDJGDGDCFMDKFICBIFBNAACKNBLBKHHOC%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DFCFENMBOOJPJINHPGGGODEFCCIPIKBPD%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DIBKNAFOBNMNDICOJAHLPPOLCAAIBNGJF%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTP://DO-SEARCH.COM/WEB/?UTM_SOURCE=B&UTM_MEDIUM=&UTM_CAMPAIGN=INSTALL_IE&UTM_CONTENT­=DS&FROM=&UID=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&TS=1420373293&TYPE=DEFAULT&Q={SEARCHTERMS}
delref HTTP://WWW.OMNIBOXES.COM/WEB/?TYPE=DS&TS=1448350801&Z=EA8AEEF19FE883C39B9D458G1Z7ZFB7C2WDE­7B8EBO&FROM=IENT07031&UID=WDCXWD10EZEX-08M2NA0_WD-WCC3F7HFSS53FSS53&Q={SEARCHTERMS}
delref HTTP://GO.MAIL.RU/SEARCH?Q={SEARCHTERMS}&FR=IEXTN&GP=821269
delref HTTP://WWW.OURSURFING.COM/WEB/?TYPE=DSPP&TS=1433044394&Z=562863EF0EDDA00DBF76F74G3ZCC2C6E9Z­CZ4C6TFZ&FROM=CMI&UID=WDCXWD10EZEX-08M2NA0_WD-WCC3F7HFSS53FSS53&Q={SEARCHTERMS}
delref HTTP://WWW.MYPLAYCITY.RU/?UTM_SOURCE=STARTMENUDESKTOPLINK&UTM_MEDIUM=DOWNLOADABLE_WEBS­ITEICON
del D:\DAYZ_STANDALONE\REDIST\TEHNIKAL SUPPORT LAUNCHER.URL
delref HTTP://WWW.MAIL.RU/CNT/20775012?GP=821267
delref HTTP://WWW.ALEXANDER-THEGAME.RU/
delref HTTP://WWW.MYPLAYCITY.RU/ONLINE_GAMES/?UTM_SOURCE=STARTMENUDESKTOPLINK&UTM_MEDIUM=DOWNLOADABLE_PLAY­ONLINEGAMES
delall %SystemDrive%\USERS\ОЛЕГ\APPDATA\LOCAL\TEMP\4D8B34EC-296DFB72-14BBF4EE-B0665DD6\301B60B7.SYS
delall %SystemDrive%\USERS\ОЛЕГ\APPDATA\LOCAL\TEMP\319F60E0.SYS
apply

;-------------------------------------------------------------

deltmp
delref %SystemDrive%\USERS\����\APPDATA\ROAMING\RUVHYMPAI.EXE
delref {23E5D772-327A-42F5-BDEE-C65C6796BB2A}\[CLSID]
delref {177AFECE-9599-46CF-90D7-68EC9EEB27B4}\[CLSID]
delref {CEF51277-5358-477B-858C-4E14F0C80BF7}\[CLSID]
delref {59116E30-02BD-4B84-BA1E-5D77E809B1A2}\[CLSID]
delref %SystemDrive%\PROGRAM FILES (X86)\GAME CENTER 101XP\UNINSTALL.EXE
delref %SystemRoot%\SYSWOW64\TBSSVC.DLL
delref %SystemRoot%\SYSWOW64\PEERDISTSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\NDIS.SYS
delref %SystemRoot%\SYSWOW64\RDPCORETS.DLL
delref %SystemRoot%\SYSWOW64\UMPO.DLL
delref %SystemRoot%\SYSWOW64\IPHLPSVC.DLL
delref %SystemRoot%\SYSWOW64\CSCSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\RDVGKMD.SYS
delref %SystemRoot%\SYSWOW64\PNRPSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\PACER.SYS
delref %SystemRoot%\SYSWOW64\LSM.EXE
delref {1F91A9A1-01BA-4C81-863D-3BA0751E1419}\[CLSID]
delref {D5FEC983-01DB-414A-9456-AF95AC9ED7B5}\[CLSID]
delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID]
delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID]
delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID]
delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID]
delref %SystemDrive%\USERS\АДМИНИСТРАТОР\APPDATA\LOCALLOW\UNITY\WEB­PLAYER\LOADER\UNITYWEBPLUGINAX.OCX
delref {88D969C0-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C1-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C2-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C3-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C4-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C5-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {CA8A9780-280D-11CF-A24D-444553540000}\[CLSID]
delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID]
delref %SystemRoot%\SYSWOW64\WIN32K.SYS
delref %SystemDrive%\PROGRAM FILES (X86)\CROSSBROWSE\CROSSBROWSE\APPLICATION\CROSSBROWSE.EXE
delref {E0DD6CAB-2D10-11D2-8F1A-0000F87ABD16}\[CLSID]
delref %SystemRoot%\SYSWOW64\BLANK.HTM
delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID]
delref {4F622628-7632-4B28-B184-D7BA0CA3273B}\[CLSID]
delref %Sys32%\DRIVERS\RDVGKMD.SYS
delref %Sys32%\MSSPELLCHECKINGFACILITY.DLL
delref %Sys32%\BLANK.HTM
delref {FE8E6AD6-DABE-45E1-88C2-48DC4578924C}\[CLSID]
delref {5F327514-6C5E-4D60-8F16-D07FA08A78ED}\[CLSID]
delref {472083B0-C522-11CF-8763-00608CC02F24}\[CLSID]
delref HELPSVC\[SERVICE]
delref SACSVR\[SERVICE]
delref VMMS\[SERVICE]
delref MESSENGER\[SERVICE]
delref RDSESSMGR\[SERVICE]
delref %Sys32%\BROWSERSERVER_2015.11.03.21.08.58.EXE
delref %Sys32%\DRIVERS\DGIVECP.SYS
delref %SystemDrive%\PROGRAM FILES (X86)\HISUITE\HANDSETSERVICE\HUAWEIHISUITESERVICE64.EXE
delref D:\ИГРА\SURVARIUM\GAME\BINARIES\X64\SURVARIUM_SERVICE.EXE
delref D:\SURVARIUM-TEST\GAME\BINARIES\X86\SURVARIUM_SERVICE.EXE
delref %Sys32%\WSMODULES.EXE
delref %SystemRoot%\XHUNTER1.SYS
delref %Sys32%\PSXSS.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\FEATURES\[email protected]
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\FEATURES\[email protected]
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\FEATURES\[email protected]
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\EXTENSIONS\{972CE4C6-7E08-4474-A285-3208198CE6FD}.XPI
delref %SystemDrive%\USERS\ОЛЕГ\APPDATA\LOCAL\YANDEX\YANDEXBROWSER\­APPLICATION\19.9.0.1343\NOTIFICATION_HELPER.EXE
delref %SystemDrive%\USERS\АДМИНИСТРАТОР\APPDATA\LOCAL\MAIL.RU\GAMECENTER\NPDETECTOR.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.26.9\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.1\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.27.5\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.15\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.1\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.13\PSMACHINE_64.DLL
delref %Sys32%\SHAREMEDIACPL.CPL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.26.9\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.1\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.27.5\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.15\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.1\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.13\PSMACHINE.DLL
delref G:\HISUITEDOWNLOADER.EXE
delref G:\LENOVO_SUITE.EXE
delref H:\SETUP.EXE
delref G:\INSTALL MEGAFON INTERNET.EXE
delref %SystemDrive%\USERS\ОЛЕГ\APPDATA\ROAMING\YANDEX\YANDEXDISK2\­YANDEXDISK2.EXE
delref %SystemDrive%\USERS\ОЛЕГ\APPDATA\LOCAL\YANDEX\BROWSERMANAGER­\MBLAUNCHER.EXE
delref D:\ИГРА\COUNTER-STRIKE 1.6 ALL-SERVERS\HL.EXE
delref D:\ИГРА\COUNTER-STRIKE 1.6 ALL-SERVERS\UNINS000.EXE
delref D:\DAYZ_STANDALONE\REDIST\DISCORD.URL
delref D:\DAYZ_STANDALONE\REDIST\LK DAYZ.URL
delref D:\DAYZ_STANDALONE\START_DAYZ_OFFLINE.EXE
delref D:\DAYZ_STANDALONE\START_DAYZ_SETTINGS.EXE
delref D:\DAYZ_STANDALONE\REDIST\TEHNIKAL SUPPORT.URL
delref D:\DAYZ_STANDALONE\REDIST\TEHNIKAL SUPPORT LAUNCHER.URL
delref D:\DAYZ_STANDALONE\REDIST\UNBAN.URL
delref D:\DAYZ_STANDALONE\UNINSTALL_GAME.EXE
delref D:\DAYZ_STANDALONE\UPDATER.EXE
delref D:\DAYZ_STANDALONE\REDIST\ZOS.STRIKEARENA.RU.URL
delref %SystemDrive%\PROGRAM FILES (X86)\STEAM\STEAM.EXE
delref D:\LEGO DIGITAL DESIGNER\LDD.EXE
delref %SystemDrive%\GAMEXP\ACCESSPOINT\ACCESSPOINT.EXE
delref %SystemDrive%\USERS\ОЛЕГ\APPDATA\LOCAL\AMIGO\APPLICATION\AMI­GO.EXE
delref D:\ИГРА\JAWS UNLEASHED\JAWS.EXE
delref D:\НОВАЯ ПАПКА\X-MEN THE OFFICIAL GAME\XMEN.EXE
delref E:\GAMES\GSC GAME WORLD\АЛЕКСАНДР\ALEXANDERTHEGREAT.EXE
delref E:\GAMES\RINGS.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\CHROME.EXE
delref D:\ИГРА\PROJECT ZOMBOID V41.45\UNINS000.EXE
delref D:\GAMES\ASSASSIN'S CREED\ASSASSINSCREED_DX10.EXE
delref D:\GAMES\ASSASSIN'S CREED\ASSASSINSCREED_DX9.EXE
delref D:\GAMES\ASSASSIN'S CREED\UNINS000.EXE
delref D:\GAMES\ASSASSINS CREED III\AC3SP.EXE
delref D:\GAMES\ASSASSINS CREED III\D.URL
delref D:\GAMES\ASSASSINS CREED III\UNINS000.EXE
delref D:\ASASIN\ASSASSIN`S CREED BROTHERHOOD\ACBSP.EXE
delref D:\ASASIN\ASSASSIN`S CREED BROTHERHOOD\UNINS000.EXE
delref D:\BEAMNG.DRIVE\BEAMNG.DRIVE.EXE
delref D:\BEAMNG.DRIVE\UNINSTALL\UNINS000.EXE
delref D:\ИГРА\BLACK MESA\BMS.EXE
delref D:\ИГРА\BLACK MESA\UNINSTALL\UNINS000.EXE
delref D:\BROFORCE\BROFORCE.EXE
delref D:\BROFORCE\UNINS000.EXE
delref D:\ИГРА\COOKING SIMULATOR\COOKINGSIM.EXE
delref D:\ИГРА\DAWNOFMAN\DAWNOFMAN.EXE
delref D:\ИГРА\FALLOUT 4\FALLOUT4.EXE
delref D:\ИГРА\FALLOUT NEW VEGAS\FALLOUTNVLAUNCHER.EXE
delref D:\ИГРА\HOUSE FLIPPER\HOUSEFLIPPER.EXE
delref D:\ИГРА\JURASSIC WORLD EVOLUTION\JWE.EXE
delref D:\ИГРА\SERIOUS SAM 3 BFE\BIN\SAM3.EXE
delref D:\ИГРА\SUBNAUTICA\SUB.EXE
delref D:\ИГРА\THE ELDER SCROLLS V SKYRIM - SPECIAL EDITION\SKYRIMSE.EXE
delref D:\ИГРА\DYING LIGHT\DYINGLIGHTGAME.EXE
delref D:\ИГРА\COOKING SIMULATOR\UNINS000.EXE
delref D:\ИГРА\DAWNOFMAN\UNINS000.EXE
delref D:\ИГРА\FALLOUT 4\UNINS000.EXE
delref D:\ИГРА\FALLOUT NEW VEGAS\UNINS000.EXE
delref D:\ИГРА\HOUSE FLIPPER\UNINS000.EXE
delref D:\ИГРА\JURASSIC WORLD EVOLUTION\UNINS000.EXE
delref D:\ИГРА\SERIOUS SAM 3 BFE\UNINS000.EXE
delref D:\ИГРА\SUBNAUTICA\UNINS000.EXE
delref D:\ИГРА\THE ELDER SCROLLS V SKYRIM - SPECIAL EDITION\UNINS000.EXE
delref D:\ИГРА\STALKER-COP.EXE
delref D:\ИГРА\UNINS000.EXE
delref D:\ИГРА\DAYZ\DAYZLAUNCH.EXE
delref D:\ИГРА\DAYZ\UNINS000.EXE
delref D:\ИГРА\DEAD AIR REBALANCE\XRENGINE.EXE
delref D:\ИГРА\DEAD AIR REBALANCE\BIN\XR_3DA.EXE
delref D:\ИГРА\DEAD AIR REBALANCE\UNINS000.EXE
delref D:\ИГРА\FALLOUT NEW VEGAS\GEMM\FOMM.EXE
delref D:\ИГРА\FALLOUT NEW VEGAS\GEMM\UNINSTALL\UNINS000.EXE
delref D:\ИГРА\FALLOUT NEW VEGAS\LAUNCHER.EXE
delref D:\FAR CRY 4 - GOLD EDITION\BIN\FARCRY4.EXE
delref D:\FAR CRY 4 - GOLD EDITION\UNINS000.EXE
delref D:\INSANE 2\REVLOADER.EXE
delref D:\INSANE 2\UNINS000.EXE
delref D:\ИГРА\LEGO MARVEL SUPER HEROES\LEGO WORLDS\LEGO_WORLDS.EXE
delref D:\ИГРА\JAWS UNLEASHED\UNINS000.EXE
delref D:\GAMES\RUN_NMS.EXE
delref D:\GAMES\UNINS000.EXE
delref D:\X-MEN - MUTANT ACADEMY 2\PSXFIN.EXE
delref D:\X-MEN - MUTANT ACADEMY 2\UNINS000.EXE
delref D:\X-MEN LEGENDS 2\XMEN2.EXE
delref D:\X-MEN LEGENDS 2\UNINS000.EXE
delref D:\ИГРА\FALLOUT NEW VEGAS\BROFORCE\BROFORCE_BETA.EXE
delref D:\ИГРА\FALLOUT NEW VEGAS\BROFORCE\UNINS000.EXE
delref D:\ИГРА\FALLOUT NEW VEGAS\JALOPY\JALOPY.EXE
delref D:\ИГРА\FALLOUT NEW VEGAS\JALOPY\UNINS000.EXE
delref D:\ИГРА\FALLOUT NEW VEGAS\KERBAL SPACE PROGRAM\KSP_X64.EXE
delref D:\ИГРА\FALLOUT NEW VEGAS\KERBAL SPACE PROGRAM\UNINS000.EXE
delref D:\ИГРА\FALLOUT NEW VEGAS\TERRARIA\TERRARIASERVER.EXE
delref D:\ИГРА\FALLOUT NEW VEGAS\TERRARIA\TERRARIA.EXE
delref D:\ИГРА\FALLOUT NEW VEGAS\TERRARIA\UNINS000.EXE
delref E:\GAMES\GSC GAME WORLD\АЛЕКСАНДР\REGISTER\REGSETUP.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. - ЗОВ ПРИПЯТИ\BIN\XRENGINE.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. - ЗОВ ПРИПЯТИ\GAMESITE.URL
delref D:\ИГРА\S.T.A.L.K.E.R. - ЗОВ ПРИПЯТИ\PUBLISHER.URL
delref D:\ИГРА\S.T.A.L.K.E.R. - ЗОВ ПРИПЯТИ\UNINS000.EXE
delref D:\HALF-LIFE 2\UNINS000.EXE
delref D:\HALF-LIFE 2\RUN_HL2.EXE
delref D:\ASASIN\JUST CAUSE 2\JUSTCAUSE2_LAUNCHER.EXE
delref D:\ASASIN\JUST CAUSE 2\UNINS000.EXE
delref D:\ИГРА\JUST CAUSE 2\JUSTCAUSE2.EXE
delref D:\ИГРА\POSTAL 2\SYSTEM\POSTAL2.EXE
delref D:\ИГРА\POSTAL 2\UNINS000.EXE
delref D:\ИГРА\LEFT TO DIE\BIN\XR_3DA.EXE
delref D:\ИГРА\LEFT TO DIE\UNINS000.EXE
delref D:\LEGO DIGITAL DESIGNER\UNINSTALL.EXE
delref D:\LEGO MARVEL SUPER HEROES\LEGOMARVEL.EXE
delref D:\LEGO MARVEL SUPER HEROES\UNINS000.EXE
delref D:\[R.G. MECHANICS] ASSASSIN'S CREED IV - BLACK FLAG\LEGO MARVELS AVENGERS\LEGOMARVELAVENGERS_DX11.EXE
delref D:\[R.G. MECHANICS] ASSASSIN'S CREED IV - BLACK FLAG\LEGO MARVELS AVENGERS\LEGOMARVELAVENGERS.EXE
delref D:\[R.G. MECHANICS] ASSASSIN'S CREED IV - BLACK FLAG\LEGO MARVELS AVENGERS\UNINS000.EXE
delref E:\GAMES\PLAY WITH ARCADE.URL
delref E:\GAMES\REGISTER GAME.URL
delref E:\GAMES\RINGSEDITOR.EXE
delref E:\GAMES\SETUP.EXE
delref E:\GAMES\LIQUID WEBSITE.URL
delref E:\GAMES\SIERRA WEBSITE.URL
delref E:\GAMES\GAME WEBSITE.URL
delref D:\ИГРА\MINECRAFT_1.13.2\VLAUNCHER.EXE
delref D:\ИГРА\MINECRAFT_1.13.2\UNINS000.EXE
delref D:\ИГРА\GRAND THEFT AUTO - SAN ANDREAS\GTA_SA.EXE
delref D:\ИГРА\GRAND THEFT AUTO - SAN ANDREAS\UNINS000.EXE
delref D:\ИГРА\GUN DISASSEMBLY 2\DISASM_CONFIG.EXE
delref D:\ИГРА\GUN DISASSEMBLY 2\DISASM-HD.EXE
delref D:\ИГРА\GUN DISASSEMBLY 2\UNINS000.EXE
delref D:\ИГРА\NS2016\BIN\XR_3DA.EXE
delref D:\ИГРА\NS2016\UNINS000.EXE
delref D:\ИГРА\MOUNT AND BLADE WARBAND\MB_WARBAND.EXE
delref D:\ИГРА\MOUNT AND BLADE WARBAND\UNINS000.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\PICEXA\PICEXA.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\PICEXA\UNINSTALL.EXE
delref D:\GAMES\R.G. CATALYST\S.T.A.L.K.E.R. - LOST ALPHA\LAUNCHER.EXE
delref D:\GAMES\R.G. CATALYST\S.T.A.L.K.E.R. - LOST ALPHA\UNINSTALL\UNINS000.EXE
delref D:\ИГРА\DISHONORED.V 1.3 + 2 DLC\BINARIES\WIN32\DISHONORED.EXE
delref D:\ИГРА\DISHONORED.V 1.3 + 2 DLC\UNINSTALL\UNINS000.EXE
delref D:\ПАУК\THE AMAZING SPIDER-MAN 2.V 1.0.0.1 + 4 DLC\ASM2LAUNCHER.EXE
delref D:\ПАУК\THE AMAZING SPIDER-MAN 2.V 1.0.0.1 + 4 DLC\GAME.EXE
delref D:\ПАУК\THE AMAZING SPIDER-MAN 2.V 1.0.0.1 + 4 DLC\UNINSTALL\UNINS000.EXE
delref D:\ИГРА\THE WITCHER 2.ASSASSINS OF KINGS.ENHANCED EDITION.V 3.4.4.1 + 12 DLC\LAUNCHER.EXE
delref D:\ИГРА\THE WITCHER 2.ASSASSINS OF KINGS.ENHANCED EDITION.V 3.4.4.1 + 12 DLC\BIN\CONFIGURATOR.EXE
delref D:\ИГРА\THE WITCHER 2.ASSASSINS OF KINGS.ENHANCED EDITION.V 3.4.4.1 + 12 DLC\BIN\WITCHER2.EXE
delref D:\ИГРА\THE WITCHER 2.ASSASSINS OF KINGS.ENHANCED EDITION.V 3.4.4.1 + 12 DLC\UNINSTALL\UNINS000.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. - CALL OF CHERNOBYL\AUTORUN.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. - LOST ALPHA DC\BINS\XR_3DA.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. - LOST ALPHA DC\UNINS000.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. - SHADOW OF CHERNOBYL\UNINSTALL.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. - SIGEROUS 2.2\STALKER-COP.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. - SIGEROUS 2.2\UNINS000.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. - SIGEROUS 2.2\STALKERLOADER.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. - ВРЕМЯ ПЕРЕМЕН 3.0\BIN\XRENGINE.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. - ВРЕМЯ ПЕРЕМЕН 3.0\UNINS000.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. ANOMALY 1.5.0\BIN\LAUNCH.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. ANOMALY 1.5.0\OLR_LAUNCHER.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. ANOMALY 1.5.0\STALKER_OLR.CMD
delref D:\ИГРА\S.T.A.L.K.E.R. ANOMALY 1.5.0\ANOMALYLAUNCHER.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. ANOMALY 1.5.0\UNINS000.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. CLEAR SKY\BIN\XRENGINE.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. CLEAR SKY\UNINS000.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. DEAD AIR (V0.98B)\UNINS000.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. LEGEND RETURNS\UNINS000.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. NLC 7\BIN\LAUNCH.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. NLC 7\UNINS000.EXE
delref D:\S.T.A.L.K.E.R. OGSR MOD\ANOMALYLAUNCHER.EXE
delref D:\S.T.A.L.K.E.R. OGSR MOD\OGSE_CONFIGURATOR.EXE
delref D:\S.T.A.L.K.E.R. OGSR MOD\BIN_X64\XRENGINE.EXE
delref D:\S.T.A.L.K.E.R. OGSR MOD\UNINS000.EXE
delref D:\[REPACK BY S.L.] S.T.A.L.K.E.R. SGM 2.2 LOST SOUL (08.04.2017)\S.T.A.L.K.E.R. SGM 2.2 LOST SOUL\STALKER-COP.EXE
delref D:\[REPACK BY S.L.] S.T.A.L.K.E.R. SGM 2.2 LOST SOUL (08.04.2017)\S.T.A.L.K.E.R. SGM 2.2 LOST SOUL\UNINS000.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. VETER VREMENI (V1.3)\STALKER-COP.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. VETER VREMENI (V1.3)\UNINS000.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. VETER VREMENI (V1.3)\ИЗБЕЖАНИЕ ВЫЛЕТОВ С ПАМЯТЬЮ.BAT
delref D:\ИГРА\S.T.A.L.K.E.R. НОВЫЙ АРСЕНАЛ 6. РЕВОЛЮЦИЯ\UNINS000.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. ТЕНЬ ЧЕРНОБЫЛЯ\BIN\XR_3DA.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. ТЕНЬ ЧЕРНОБЫЛЯ\UNINS000.EXE
delref D:\ИГРА\STALKER-CS COMPLETE\BIN\XRENGINE.EXE
delref D:\ИГРА\STALKER-CS COMPLETE\UNINS000.EXE
delref D:\ИГРА\TES V - SKYRIM\SKYRIMLAUNCHER.EXE
delref D:\ИГРА\TES V - SKYRIM\TESV.EXE
delref D:\ИГРА\TES V - SKYRIM\UNINS000.EXE
delref D:\ИГРА\S.T.A.L.K.E.R. - LOST ALPHA DC\LOST ALPHA CONFIGURATOR.EXE
delref D:\ИГРА\STCOP + ATMOSFEAR + ABSOLUTE NATURE\STALKER-COP.EXE
delref D:\ИГРА\STCOP + ATMOSFEAR + ABSOLUTE NATURE\UNINS000.EXE
delref D:\ИГРА\STCS WEAPON PACK. CLEAR SKY\BIN\XRENGINE.EXE
delref D:\ИГРА\STCS WEAPON PACK. CLEAR SKY\UNINS000.EXE
delref D:\ИГРА\GARRYS MOD\ULTIMATENAMECHANGER.EXE
delref D:\ИГРА\GARRYS MOD\GARRYS_MOD.EXE
delref D:\ИГРА\GARRYS MOD\UNINS000.EXE
delref D:\ИГРА\GARRYS MOD\GMOD_UPDATER.EXE
delref D:\ИГРА\SURVARIUM\GAME\BINARIES\X64\SURVARIUM_LAUNCHER.EXE
delref D:\ИГРА\SURVARIUM\GAME\BINARIES\X64\SURVARIUM_UPDATER.EXE
delref D:\SURVARIUM-TEST\GAME\BINARIES\X86\SURVARIUM_LAUNCHER.EXE
delref D:\SURVARIUM-TEST\UNINS000.EXE
delref D:\ИГРА\THE ESCAPISTS 2\THEESCAPISTS2.EXE
delref D:\ИГРА\THE ESCAPISTS 2\UNINS000.EXE
delref D:\ИГРА\TORCHLIGHT 2\MODLAUNCHER.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\WINZIPPER\EUNINSTALL.EXE
delref D:\ИГРА\NS2011 - DMX EDITION\BIN\XR_3DA.EXE
delref D:\ИГРА\НАРОДНАЯ СОЛЯНКА 2016 OGSR ENGINE\UNINS000.EXE
delref D:\ОП-2 SETUP\S.T.A.L.K.E.R\BIN\XR_3DA.EXE
restart
;---------command-block---------
delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLKIT.SYS
delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLMON.SYS
delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLR3.SYS
delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFESVC.EXE
delall %SystemDrive%\USERS\ОЛЕГ\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFI­LES\T6EP4DB9.DEFAULT-1606081229326\CACHE2\ENTRIES\E9D4855275F6667E94DE38140168730­8378A5B96
apply


</code>

2) Если в папке с uVS будет файл ZOO*** - пришлите файл в почту [email protected]
Если помните откуда скачивали\устанавливали: Discord 0.0.309
то ссылку также в почту.


3) Выполните лог в AdwCleaner
http://forum.esetnod32.ru/forum9/topic7084/

после завершения сканирования:
Записи относящиеся к Mail.Ru и Yandex можете не удалять ( если пользуетесь программой )
На вкладке:
Папки (Folders) для Mail.Ru  и Yandex снимите [V]


Удалите найденное в AdwCleaner по кнопке Очистить (Clean), подтвердите действие
с автоперезагрузкой

4) Далее выполните FRST: http://forum.esetnod32.ru/forum9/topic2798/

1) Скопируйте текст КОДа - в буфер обмена.
uVS: start.exe, текущий пользователь, меню, скрипты - выполнить скрипт из буфера обмена.
ПЕРЕД ВЫПОЛНЕНИЕМ СКРИПТА, ЗАКРЫТЬ БРАУЗЕРЫ!
ВНИМАНИЕ : По окончанию выполнения скрипта компьютер выполнит перезагрузку !


<code>

;uVS v4.11 [http://dsrt.dyndns.org:8888]
;Target OS: NTv6.1
v400c
OFFSGNSAVE
zoo %SystemDrive%\USERS\HOME\APPDATA\ROAMING\MICROSOFT\ADMODNETW­4B8\ADNEKMOD8B4.DLL
czoo
regt 18
regt 25
regt 26
regt 38
deltmp
restart
;---------command-block---------
delall %SystemDrive%\USERS\HOME\APPDATA\ROAMING\MICROSOFT\ADMODNETW­4B8\ADNEKMOD8B4.DLL
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DEOFCBNMAJMJMPLFLAPAOJJNIHCJKIGCK%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref %SystemDrive%\USERS\HOME\APPDATA\LOCAL\YANDEX\YANDEXBROWSER\­USER DATA\DEFAULT\EXTENSIONS\MDPLJNDCMBEIKFNLFLCGGAIPGNHIEDBL\9.27_0\SAVEFROM.NET ПОМОЩНИК
delref %SystemDrive%\USERS\HOME\APPDATA\LOCAL\YANDEX\YANDEXBROWSER\­USER DATA\DEFAULT\EXTENSIONS\NPDPPLBICNMPOIGIDFDJADAMGFKILAAK\9.27_0\SAVEFROM.NET ПОМОЩНИК
delref $E082E,3766895,54272,C:\USERS\HOME\DOWNLOADS\TUNNGLE_SETUP_V4.5.1.4B.EXE
delref G:\ADWCLEANER_8.0.0.EXE
delref %SystemDrive%\PROGRAM FILES\AVAST SOFTWARE\AVAST\AVEMUPDATE.EXE
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\AVAST SOFTWARE\OVERSEER\OVERSEER.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\KERISH DOCTOR\KERISHDOCTOR.EXE
delref {23E5D772-327A-42F5-BDEE-C65C6796BB2A}\[CLSID]
delref {177AFECE-9599-46CF-90D7-68EC9EEB27B4}\[CLSID]
delref {CEF51277-5358-477B-858C-4E14F0C80BF7}\[CLSID]
delref {59116E30-02BD-4B84-BA1E-5D77E809B1A2}\[CLSID]
delref %SystemDrive%\PROGRAM FILES (X86)\BLUESTACKS\HD-RUNTIMEUNINSTALLER.EXE
delref %SystemRoot%\SYSWOW64\TBSSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\NDIS.SYS
delref %SystemRoot%\SYSWOW64\UMPO.DLL
delref %SystemRoot%\SYSWOW64\IPHLPSVC.DLL
delref %SystemRoot%\SYSWOW64\PNRPSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\PACER.SYS
delref %SystemRoot%\SYSWOW64\LSM.EXE
delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID]
delref {CA8A9780-280D-11CF-A24D-444553540000}\[CLSID]
delref {D27CDB6E-AE6D-11CF-96B8-444553540000}\[CLSID]
delref %SystemRoot%\SYSWOW64\WIN32K.SYS
delref {E0DD6CAB-2D10-11D2-8F1A-0000F87ABD16}\[CLSID]
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\57.0.2987.133\INSTALLER\CHRMSTP.EXE
delref %SystemRoot%\SYSWOW64\BLANK.HTM
delref SLDWORKS SHELL EXTENSION\[CLSID]
delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID]
delref {474C98EE-CF3D-41F5-80E3-4AAB0AB04301}\[CLSID]
delref {7EFA68C6-086B-43E1-A2D2-55A113531240}\[CLSID]
delref D:\
delref %Sys32%\MSSPELLCHECKINGFACILITY.DLL
delref %Sys32%\BLANK.HTM
delref %SystemDrive%\PROGRAM FILES\AMD\CNEXT\CNEXT\ATIACM64.DLL
delref {472083B0-C522-11CF-8763-00608CC02F24}\[CLSID]
delref APPMGMT\[SERVICE]
delref HELPSVC\[SERVICE]
delref SACSVR\[SERVICE]
delref VMMS\[SERVICE]
delref MESSENGER\[SERVICE]
delref RDSESSMGR\[SERVICE]
delref %Sys32%\DRIVERS\ADGNETWORKTDI.SYS
delref %Sys32%\DRIVERS\EAGLEX64.SYS
delref %Sys32%\PSXSS.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\EXTENSIONS\{972CE4C6-7E08-4474-A285-3208198CE6FD}
delref %SystemDrive%\PROGRAM FILES (X86)\PDF ARCHITECT\FFPDFARCHITECTEXT
delref %SystemDrive%\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
delref %SystemDrive%\USERS\ДИМА\APPDATA\ROAMING\MOZILLA\FIREFOX\PRO­FILES\NAHD6HA2.DEFAULT\EXTENSIONS\{6221D3F4-D69D-46E5-B989-B5FDE79C2247}.XPI
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\FEATURES\[email protected]
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\FEATURES\[email protected]
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\FEATURES\[email protected]
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\EXTENSIONS\{972CE4C6-7E08-4474-A285-3208198CE6FD}.XPI
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\GOOGLE.XML
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\MAILRU.XML
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\OZONRU.XML
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\PRICERU.XML
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\WIKIPEDIA-RU.XML
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\YANDEX-SLOVARI.XML
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\YANDEX.XML
delref %SystemDrive%\PROGRAM FILES\AUTODESK\3DS MAX 2020\INVENTOR SERVER\BIN\TESTSERVER.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.26.9\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\BLUESTACKS\BSTKSVC.EXE
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDMFTDECODER_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.23\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDHWDECODER_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.1\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.442\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.32\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\SOLIDWORKS SHARED\SLDSHELLUTILS10U.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\BLUESTACKS\BSTKC.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.32.7\PSMACHINE_64.DLL
delref D:\ПРОГРАММЫ\SOLIDWORKS 2013 SP3.0\SOLIDWORKS\SCANTO3D\ADDIN\NEMODEL.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.17\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.27.5\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.34.11\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.15\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.1\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.5\PSMACHINE_64.DLL
delref D:\ПРОГРАММЫ\SOLIDWORKS 2013 SP3.0\SOLIDWORKS\DSGNCHK\DSGNCHKBLDU.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.7\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDMFTVIDEODECODER_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.25.11\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.3\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.452\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDH264ENC64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.13\PSMACHINE_64.DLL
delref %Sys32%\SHAREMEDIACPL.CPL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.5\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.31.5\PSMACHINE_64.DLL
delref D:\ПРОГРАММЫ\FL STUDIO 12\PLUGINS\FRUITY\EFFECTS\ZGAMEEDITOR VISUALIZER\MEDIAVIDEODECODER_X64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.30.3\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.26.9\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDMFTDECODER_32.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.23\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDHWDECODER_32.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.1\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.442\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.32\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.32.7\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.17\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.27.5\PSMACHINE.DLL
delref D:\ПРОГРАММЫ\SOLIDWORKS 2013 SP3.0\SOLIDWORKS\SWVBASERVER\SWVBASERVER.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.34.11\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.15\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.1\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.5\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.7\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDMFTVIDEODECODER_32.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.25.11\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.3\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.452\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.23\GOOGLEUPDATEBROKER.EXE
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\ATI TECHNOLOGIES\MULTIMEDIA\AMDH264ENC32.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.13\PSMACHINE.DLL
delref D:\ПРОГРАММЫ\SOLIDWORKS 2013 SP3.0\SOLIDWORKS\SIMULATION\PARAMETRICOBJECT.EXE
delref D:\ПРОГРАММЫ\SOLIDWORKS 2013 SP3.0\SOLIDWORKS EDRAWINGS\EDRAWINGOFFICEAUTOMATOR.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.5\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.31.5\PSMACHINE.DLL
delref D:\ПРОГРАММЫ\FL STUDIO 12\PLUGINS\FRUITY\EFFECTS\ZGAMEEDITOR VISUALIZER\MEDIAVIDEODECODER.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.30.3\PSMACHINE.DLL
delref G:\HISUITEDOWNLOADER.EXE
delref E:\AUTOPLAY.EXE
delref G:\AUTORUN.EXE
delref H:\HISUITEDOWNLOADER.EXE
delref {7AEFE841-DCA1-4A95-80CB-BE935D020400}\[CLSID]
delref {92780B25-18CC-41C8-B9BE-3C9C571A8263}\[CLSID]
delref D:\ПРОГРАММЫ\FL STUDIO 12\FL64.EXE
delref D:\1GAMES\BEAMNG.DRIVE 0.4.0.2\BEAMNG.DRIVE.EXE
delref D:\1GAMES\BEAMNG.DRIVE\UNINS000.EXE
delref D:\ПРОГРАММЫ\FL STUDIO 12\FL.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\RAIDCALL\RAIDCALL.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\RAIDCALL\UNINST.EXE
delref D:\1GAMES\RIMWORLD\RIMWORLD914WIN.EXE
delref D:\1GAMES\THE BINDING OF ISAAC - AFTERBIRTH\ISAAC-NG.EXE
delref D:\1GAMES\THE BINDING OF ISAAC - AFTERBIRTH\UNINS000.EXE
apply


</code>

+

2) Если в папке с uVS будет файл ZOO*** - пришлите файл в почту [email protected]

3) Выполните лог в AdwCleaner
http://forum.esetnod32.ru/forum9/topic7084/

после завершения сканирования:
Записи относящиеся к Mail.Ru и Yandex можете не удалять ( если пользуетесь программой )
На вкладке:
Папки (Folders) для Mail.Ru  и Yandex снимите [V]


Удалите найденное в AdwCleaner по кнопке Очистить (Clean), подтвердите действие
с автоперезагрузкой

4) Далее выполните FRST: http://forum.esetnod32.ru/forum9/topic2798/