Hola @bigardo:
Disculpa el restraso en el análisis de tus informes.
- Desinstala las sigueintes extensiones de Chrome:
Avast SafePrice | Comparaciones, ofertas y cupones
Avast Online Security
Chrome Media Router
- Desinstala el siguiente programa:
Argente - Registry Cleaner 3.1.2.0
Para desinstalarlo , te recomiendo usar Revo Uninstaller, el cual elimina todo rastro de los programas a desinstalar. En este enlace tienes el Manual de RevoUninstaller donde tendrás adicionalmente un ejemplo de cómo desinstalar adecuadamente un programa.
Ejecuta RevoUninstaller según el manual anteriormente dado y escoge, cuando el programa lo habilite, el Modo Avanzado.
Luego sigue estos pasos :
1.- Muy
Importante >>> Realizar una copia de Seguridad de su
Registro.
- Descarga y ejecuta DelFix en el escritorio de Windows.
- Clic Derecho, “Ejecutar como Administrador”.
- En la ventana principal, marca solamente la casilla “Create Registry Backup”.
- Clic en Run.
Al terminar se abrirá un reporte llamado DelFix.txt, guárdelo por si fuera necesario y cierre la herramienta…
2.- Desactiva Temporalmente tu antivirus.
3.- Abre un nuevo archivo Notepad/Bloc de Notas y copia y pega este contenido:
Start
CloseProcesses:
CreateRestorePoint:
HKU\S-1-5-21-2501560046-1431078658-2197496327-1000\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [27775672 2020-05-01] (Piriform Software Ltd -> Piriform Software Ltd)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\81.0.4044.138\Installer\chrmstp.exe [2020-05-16] (Google LLC -> Google LLC)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{9459C573-B17A-45AE-9F64-1857B5D58CEE}] -> C:\Program Files (x86)\Microsoft\Edge\Application\81.0.416.77\Installer\setup.exe [2020-05-19] (Microsoft Corporation -> Microsoft Corporation)
HKLM\Software\...\Authentication\Credential Providers: [{503739d0-4c5e-4cfd-b3ba-d881334f0df2}] ->
BootExecute: autocheck autochk * les (x86)\Glary Utilities 5\data\gulr.dat
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restricción <==== ATENCIÓN
CHR HKLM\SOFTWARE\Policies\Google: Restricción <==== ATENCIÓN
Task: {54CFC965-2A13-49F3-895B-40E24254408D} - System32\Tasks\Microsoft\Windows\End Of Support\Notify2 => C:\WINDOWS\system32\sipnotify.exe
Task: {C9DCA5B2-0A8B-4278-BE3B-E8C37E6EA652} - System32\Tasks\Microsoft\Windows\End Of Support\Notify1 => C:\WINDOWS\system32\sipnotify.exe
Toolbar: HKU\S-1-5-21-2501560046-1431078658-2197496327-1000 -> Sin Nombre - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Ningún archivo
Edge StartupUrls: Default -> "hxxps://www.google.com/","hxxp://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://es.yahoo.com/?fr=hp-avast&type=avastbcl","hxxps://es.yahoo.com/?fr=hp-avast&type=avastbcl","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxp://www.google.es/"
FF Plugin: @videolan.org/vlc,version=3.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2020-04-23] (VideoLAN -> VideoLAN)
CHR StartupUrls: Default -> "hxxps://www.google.com/","hxxp://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://es.yahoo.com/?fr=hp-avast&type=avastbcl","hxxps://es.yahoo.com?fr=hp-avast&type=avastbcl","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxp://www.google.es/"
CHR Extension: (Avast SafePrice | Comparaciones, ofertas y cupones) - C:\Users\ANTONIO\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2020-03-20]
CHR Extension: (Avast Online Security) - C:\Users\ANTONIO\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2020-02-28]
CHR Extension: (Chrome Media Router) - C:\Users\ANTONIO\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2020-04-22]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki]
U3 idsvc; no ImagePath
2020-05-20 16:36 - 2020-05-20 16:36 - 000008850 _____ C:\Users\ANTONIO\Desktop\ZHPCleaner (R).html
2020-05-20 16:36 - 2020-05-20 16:36 - 000002510 _____ C:\Users\ANTONIO\Desktop\6 - ZHPCleaner (R).txt
2020-05-20 16:29 - 2020-05-20 16:29 - 000002315 _____ C:\Users\ANTONIO\Desktop\5 - ZHPCleaner 20-05-20.txt
2020-05-20 16:27 - 2020-05-20 16:27 - 000002344 _____ C:\Users\ANTONIO\Desktop\4 - ZHPCleaner (S)20-05-20.txt
2020-05-20 16:17 - 2020-05-20 16:36 - 000000000 ____D C:\Users\ANTONIO\AppData\Roaming\ZHP
2020-05-20 16:17 - 2020-05-20 16:17 - 000000000 ____D C:\Users\ANTONIO\AppData\Local\ZHP
2020-05-20 16:16 - 2020-05-20 16:12 - 000001869 _____ C:\Users\ANTONIO\Desktop\3 - AdwCleaner[C00]20-05-20 tras reinicio.txt
2020-05-20 16:12 - 2020-05-20 16:11 - 000001849 _____ C:\Users\ANTONIO\Desktop\2 - AdwCleaner[S00] 20-05-20.txt
2020-05-20 16:07 - 2020-05-20 16:07 - 000004983 _____ C:\Users\ANTONIO\Desktop\1 - ccleaner 20-05-20.txt
2019-11-08 18:12 - 2019-11-08 18:12 - 000000000 _____ () C:\Users\ANTONIO\AppData\Local\oobelibMkey.log
HKU\S-1-5-21-2501560046-1431078658-2197496327-1000\...\ChromeHTML: -> <==== ATENCIÓN
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => -> Ningún archivo
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => -> Ningún archivo
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => -> Ningún archivo
ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => -> Ningún archivo
ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => -> Ningún archivo
ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => -> Ningún archivo
WMI:subscription\__FilterToConsumerBinding->CommandLineEventConsumer.Name=\"BVTConsumer\"",Filter="__EventFilter.Name=\"BVTFilter\"::
WMI:subscription\__EventFilter->BVTFilter::[Query => SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99]
WMI:subscription\CommandLineEventConsumer->BVTConsumer::[CommandLineTemplate => cscript KernCap.vbs][WorkingDirectory => C:\\tools\\kernrate]
ShortcutWithArgument: C:\Users\ANTONIO\Desktop\Google.lnk -> C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe (Microsoft Corporation) -> --profile-directory=Default --app-id=eejlldcgggidmknlgbhdlfhgdbneaneo
ShortcutWithArgument: C:\Users\ANTONIO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google.lnk -> C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe (Microsoft Corporation) -> --profile-directory=Default --app-id=eejlldcgggidmknlgbhdlfhgdbneaneo
ShortcutWithArgument: C:\Users\ANTONIO\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google.lnk -> C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe (Microsoft Corporation) -> --profile-directory=Default --app-id=eejlldcgggidmknlgbhdlfhgdbneaneo
ShortcutWithArgument: C:\Users\ANTONIO\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk -> C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe (Microsoft Corporation) -> --profile-directory=Default
HKLM\software\microsoft\Windows\CurrentVersion\Telephony\Providers => ProviderFileName2 -> ndptsp.tsp (Ningún archivo)
VirusTotal: C:\WINDOWS\GA_OF.dat; C:\Windows\SysWOW64\fmcodec.dll
CMD: ipconfig /flushdns
CMD: ipconfig /renew
CMD: bitsadmin /reset /allusers
CMD: netsh winsock reset
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
RemoveProxy:
EmptyTemp:
Hosts:
END
- Lo guardas bajo el nombre de fixlist.txt en el escritorio <<< Esto es muy importante.
Nota: Es necesario que el ejecutable Frst.exe y fixlist.txt se encuentren en la misma ubicación (escritorio) o si no la herramienta no trabajara.
- Ejecutas Frst.exe.
- Presionas el botón Corregir y aguardas a que termine.
- La Herramienta guardara el reporte en tu escritorio (Fixlog.txt).
- Lo pegas en tu próxima respuesta.
