Вирус

[Vadum123]

Когда я хочу зайти в гугл то воно мене перенаправляє на Search.ru що робити поможіть

Вложения:

You must be logged in to view attached files.

[mike_1]

ВНИМАНИЕ! Данный скрипт написан специально для этого пользователя, использование его на другом компьютере может привести к неработоспособности Windows!

Временно выгрузите антивирус, файрволл и прочее защитное ПО.
Скопируйте приведенный ниже текст в Блокнот и сохраните файл как fixlist.txt в ту же папку откуда была запущена утилита Farbar Recovery Scan Tool:

CMD: wmic /Namespace:\\root\default Path SystemRestore Call Enable "%SystemDrive%"
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-771906959-3879504242-1204861947-1001\...\Run: [qlyfaitcao] => explorer "hxxp://granena.ru/?utm_source=uoua03n&utm_content=e739009bccd5f1e6d71a91bff5994529&utm_term=E5B029B1953A306AC81723F425178AA8&utm_d=20160922" <===== ATTENTION
File: C:\ProgramData\DriverAgentPlus\DriverAgentPlus.exe
File: C:\ProgramData\UpdateReminder\UpdateReminder.exe
GroupPolicy: Restriction - Chrome <======= ATTENTION
GroupPolicy\User: Restriction ? <======= ATTENTION
GroupPolicyScripts: Restriction <======= ATTENTION
GroupPolicyScripts\User: Restriction <======= ATTENTION
Toolbar: HKU\S-1-5-21-771906959-3879504242-1204861947-1001 -> Searchgo - {2BC46CFA-4B00-4193-A7BD-6AD1D0BCB5BC} - C:\Users\вадими\AppData\LocalLow\SearchGo\searchgo.dll [2016-10-03] (Searchgo)
BHO: Searchgo Class -> {598AEFC6-DD3C-4A63-9AC3-53FCF6155931} -> C:\Users\вадими\AppData\LocalLow\SearchGo\searchgo.dll [2016-10-03] (Searchgo)
SearchScopes: HKU\S-1-5-21-771906959-3879504242-1204861947-1001 -> {A06ED961-D98F-4CF9-A89B-80AB11DB149C} URL = hxxp://go-search.ru/search?q={searchTerms}
CHR Extension: (No Name) - C:\Users\вадими\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-09-28]
CHR Extension: (No Name) - C:\Users\вадими\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccfifbojenkenpkmnbnndeadpfdiffof [2016-11-06]
CHR Extension: (No Name) - C:\Users\вадими\AppData\Local\Google\Chrome\User Data\Default\Extensions\cpmgdbdchhjimcbfbbhlbchbobhjonna [2016-12-10]
CHR Extension: (MediaSecond files download helper) - C:\Users\вадими\AppData\Local\Google\Chrome\User Data\Default\Extensions\fidgfgjjfmicejfgkmmnoomabpnegocl [2016-12-09]
CHR Extension: (Домашняя страница Mail.Ru) - C:\Users\вадими\AppData\Local\Google\Chrome\User Data\Default\Extensions\icanjjkadceebmhanpekkofdhclnoijl [2016-11-06]
CHR Extension: (Chrome Web Store Payments) - C:\Users\вадими\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-09-28]
CHR Extension: (Визуальные Закладки Mail.Ru) - C:\Users\вадими\AppData\Local\Google\Chrome\User Data\Default\Extensions\oelpkepjlgmehajehfeicfbjdiobdkfj [2016-11-06]
CHR Extension: (Mail.Ru) - C:\Users\вадими\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojlcebdkbpjdpiligkdbbkdkfjmchbfd [2016-12-09]
CHR HKLM\...\Chrome\Extension: [ccfifbojenkenpkmnbnndeadpfdiffof] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx <not found>
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
CHR HKLM\...\Chrome\Extension: [icanjjkadceebmhanpekkofdhclnoijl] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [oelpkepjlgmehajehfeicfbjdiobdkfj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [ojlcebdkbpjdpiligkdbbkdkfjmchbfd] - hxxps://clients2.google.com/service/update2/crx
OPR StartupUrls: "hxxp://granena.ru/?utm_content=31b5cebd524a9af6c7a772dca81815e9&utm_source=startpm&utm_term=E5B029B1953A306AC81723F425178AA8&utm_d=20160922"
OPR Extension: (Tampermonkey) - C:\Users\вадими\AppData\Roaming\Opera Software\Opera Stable\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2016-11-29]
OPR Extension: (Free Flash, Unity3D and html5 games) - C:\Users\вадими\AppData\Roaming\Opera Software\Opera Stable\Extensions\egjicgmgibgofmekojoaaddjkagfajjh [2016-10-30]
OPR Extension: (MediaSecond files download helper) - C:\Users\вадими\AppData\Roaming\Opera Software\Opera Stable\Extensions\fidgfgjjfmicejfgkmmnoomabpnegocl [2016-12-09]
S4 ContentProtector; C:\Program Files\ContentProtector\ContentProtector.exe [584936 2016-05-05] ("Artex Management S. A.")
S4 ContentProtectorUpdate; C:\Program Files\ContentProtector\ContentProtectorUpdate.exe [233704 2016-05-05] ("Artex Management S. A.")
R2 Gerquzbaph; C:\Program Files\Nerqucleredom\Plnprovider.dll [281088 2016-09-22] () [File not signed]
S4 TCPnP3; C:\Program Files\TCPnp3\TCPnP3.exe [190468 2016-09-22] () [File not signed] <==== ATTENTION
S4 TCPnP4; C:\Program Files\TCPnp4\TCPnP4.exe [190468 2016-09-22] () [File not signed] <==== ATTENTION
S4 TCPnP5; C:\Program Files\TCPnp5\TCPnP5.exe [190468 2016-09-22] () [File not signed] <==== ATTENTION
S4 TCPnP6; C:\Program Files\TCPnp6\TCPnP6.exe [190468 2016-09-22] () [File not signed] <==== ATTENTION
S4 UbarPolicyProvider; C:\Program Files\UBar\UbarService.exe [83464 2016-09-22] ()
S2 UDPnP33; "D:\Program Files\UDPdp\UDPnp3\UDPdp33.exe" 3e19779b2974487e881c2174c0562504 [X]
S2 UDPnP44; "D:\Program Files\UDPdp\UDPnp4\UDPdp44.exe" b48f42ba07304dd38f2ef02dfd46c678 [X]
S2 UDPnP55; "D:\Program Files\UDPdp\UDPnp5\UDPdp55.exe" 388837891c4f496ea6203a5f71b2a421 [X]
S2 UDPnP66; "D:\Program Files\UDPdp\UDPnp6\UDPdp66.exe" affe6dc7e5264e7e8e5695737342bee0 [X]
R1 ContentProtectorDrv; C:\Windows\system32\drivers\ContentProtectorDrv.sys [47424 2016-04-19] ()
2016-12-09 16:50 - 2016-12-19 15:06 - 00001810 __RSH C:\Users\Все пользователи\ntuser.pol
2016-12-09 16:50 - 2016-12-19 15:06 - 00001810 __RSH C:\ProgramData\ntuser.pol
Task: {1DADF474-1D95-403A-968A-1CE539CE7EAC} - System32\Tasks\ComDev => C:\Users\VADIM\AppData\Local\ComDev\ComDev.exe <==== ATTENTION
Task: {23F486BA-26B5-4D2F-8242-0F1A965D3AAD} - System32\Tasks\Update Service for Youtube AdBlock => C:\Program Files\Youtube AdBlock\FjVqjUF.exe [2016-12-09] () <==== ATTENTION
Task: {6854E131-F3C8-40A5-B0B4-014372541DDB} - System32\Tasks\fupdate => C:\Users\VADIM\AppData\Local\fupdate\fupdate.exe <==== ATTENTION
Task: {89CDABE8-8379-4132-89C5-2EC75E60E158} - System32\Tasks\svshost => C:\Users\вадими\AppData\Local\svshost\svshost.exe [2016-12-17] () <==== ATTENTION
C:\Users\вадими\AppData\Local\svshost
Task: {EA13CD76-B25F-41E6-B1B4-0D6701C03AFB} - System32\Tasks\SearchGo Task => C:\Users\вадими\AppData\Local\SearchGo\searchgo.exe [2016-10-03] (Searchgo) <==== ATTENTION
Task: {F4DDBEFC-C735-4E06-9FFF-4B85743D3246} - System32\Tasks\InternetC => C:\Program Files\Opera\41.0.2353.46\opera.exe
Task: C:\Windows\Tasks\Update Service for Youtube AdBlock.job => C:\Program Files\Youtube AdBlock\FjVqjUF.exe <==== ATTENTION
C:\Users\вадими\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.lnk
MSCONFIG\Services: ContentProtector => 2
MSCONFIG\Services: ContentProtectorUpdate => 2
MSCONFIG\Services: TCPnP3 => 2
MSCONFIG\Services: TCPnP4 => 2
MSCONFIG\Services: TCPnP5 => 2
MSCONFIG\Services: TCPnP6 => 2
MSCONFIG\Services: UbarPolicyProvider => 2
MSCONFIG\startupreg: twksschkht => explorer "http://granena.ru/?utm_source=uoua03n&utm_content=e739009bccd5f1e6d71a91bff5994529&utm_term=E5B029B1953A306AC81723F425178AA8&utm_d=20160922"
EmptyTemp:

Запустите FRST и нажмите один раз на кнопку Fix и подождите. Программа создаст лог-файл (Fixlog.txt). Пожалуйста, прикрепите его в следующем сообщении!
Обратите внимание, что компьютер будет перезагружен.

Сделайте http://virusinfo.info/showthread.php?t=146192

[Автор]

Сообщения