Вирус создает в папке Temp tmp.exe - Удаление вирусов - Ответ 10725408

start
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
AppInit_DLLs: C:\ProgramData\Subair\Ozer-Tam.dll => No File
C:\ProgramData\Subair\
GroupPolicy: Restriction - Chrome <==== ATTENTION
GroupPolicyScripts: Restriction <==== ATTENTION
HKU\S-1-5-21-2118487342-915170262-173200590-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBEQo0lOCwIxrzs2Rcb6iYsYwGCgfbLBmeOYJz_FdY4wfVMRWJuAzK1cYlO9ujGyxqV5XkHLRhg1U4SloYJbnnG4kN-SOEaUVxrl7q6eol-kkJLRjM0b3Rwg4perT4Tm9dhuEqiRBaeKChoyScD9DlA__8ocPzmJn4nAZwBpxD3N7jdmsZsSZrW8szgx6M,&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL = 
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBEQo0lOCwIxrzs2Rcb6iYsYwGCgfbLBmeOYJz_FdY4wfVMRWJuAzK1cYlO9ujGyxqV5XkHLRhg1U4SloYJbnnG4kN-SOEaUVxrl7q6eol-kkJLRjM0b3Rwg4perT4Tm9dhuEqiRBaeKChoyScD9DlA__8ocPzmJn4nAZwBpxD3N7jdmsZsSZrW8szgx6M,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2118487342-915170262-173200590-1000 -> {ielnksrch} URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBEQo0lOCwIxrzs2Rcb6iYsYwGCgfbLBmeOYJz_FdY4wfVMRWJuAzK1cYlO9ujGyxqV5XkHLRhg1U4SloYJbnnG4kN-SOEaUVxrl7q6eol-kkJLRjM0b3Rwg4perT4Tm9dhuEqiRBaeKChoyScD9DlA__8ocPzmJn4nAZwBpxD3N7jdmsZsSZrW8szgx6M,&q={searchTerms}
CHR HomePage: Default -> hxxps://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBEQo0lOCwIxrzs2Rcb6iYsYwGCgfbLBmeOYJz_FdY4wfVMRWJuAzK1cYlO9ujGyxqV5XkHLRhg1U4SloYJbnnG4kN-SOEaUVxrl6GZah-P1Gsew93DlbA-VHpU2fWs9pZ7qGzOsTjY1RtmmPQq8HKdTyqUIjwihWEzR0Bc2BxCIrUAS2-AyXJYRD_np0g,
CHR DefaultSearchURL: Default -> hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBEQo0lOCwIxrzs2Rcb6iYsYwGCgfbLBmeOYJz_FdY4wfVMRWJuAzK1cYlO9ujGyxqV5XkHLRhg1U4SloYJbnnG4kN-SOEaUVxrl639ypl94KpKC9_HEYVWnuU08c3RcMg-qh0MBAPJnTyQDuo_ZRL8BibcWJtKnSvhgI9MCY0gKTLpWOgA-T7Bd2GSJ_w,&q={searchTerms}
CHR DefaultSearchKeyword: Default -> feed.sonic-search.com
OPR Extension: (No Name) - C:\Users\User\AppData\Roaming\Opera Software\Opera Stable\Extensions\clliemkgoekbejfjjaodogdfimdgapdf [2017-07-31]
2017-08-31 13:16 - 2017-08-31 13:16 - 000000258 __RSH C:\Users\User\ntuser.pol
2017-08-31 21:39 - 2017-07-31 12:03 - 000000000 ____D C:\Program Files (x86)\YueAckU
2017-08-31 21:39 - 2017-07-31 12:03 - 000000000 ____D C:\Program Files (x86)\YtuAskU2
2017-08-31 21:39 - 2017-07-31 12:03 - 000000000 ____D C:\Program Files (x86)\YeuAskIE
2017-08-31 21:39 - 2017-07-29 23:55 - 000000000 ____D C:\Users\Все пользователи\Subair
2017-08-31 21:39 - 2017-07-29 23:55 - 000000000 ____D C:\ProgramData\Subair
2017-08-31 14:43 - 2017-07-29 23:55 - 000003090 __RSH C:\Users\Все пользователи\ntuser.pol
2017-08-31 14:43 - 2017-07-29 23:55 - 000003090 __RSH C:\ProgramData\ntuser.pol
Hosts:
HKU\S-1-5-21-2118487342-915170262-173200590-1000\...\StartupApproved\Run: => "H2XORqUsJk.exe"
HKU\S-1-5-21-2118487342-915170262-173200590-1000\...\StartupApproved\Run: => "lW9fUUHi0zH9f.exe"
HKU\S-1-5-21-2118487342-915170262-173200590-1000\...\StartupApproved\Run: => "NnE0DML3.exe"
HKU\S-1-5-21-2118487342-915170262-173200590-1000\...\StartupApproved\Run: => "setupsk_upd"
HKU\S-1-5-21-2118487342-915170262-173200590-1000\...\StartupApproved\Run: => "setupsk"
HKU\S-1-5-21-2118487342-915170262-173200590-1000\...\StartupApproved\Run: => "qJNeGIzH3QLr0.exe"
HKU\S-1-5-21-2118487342-915170262-173200590-1000\...\StartupApproved\Run: => "R6qOlv8sV8DS.exe"
CMD: ipconfig /flushdns
CMD: IPCONFIG /release
CMD: IPCONFIG /renew
CMD: gpupdate /force
CMD: bitsadmin /reset /allusers
EmptyTemp:
Reboot:
end