Hola @SanMar !
-Te comento que hice todo rigurosamente, según quedó indicado, CCleaner lo eliminé usando Revo. -Creé un backup del registro con Delfix. -Copié FRST al escritorio, cree el archivo “txt” con el script y lo dejé en el escritorio también.
En el último paso tuve un problema, ya que al iniciar frst y darle “fix”, el programa inició, todo parecía bien, pero al cabo de un rato se congeló y quedó en modo “No responde” demasiado tiempo. en el Log, creo que se nota que no terminó todo su proceso. Al quedar pegado, quedó en pantalla que lo último que estaba haciendo era “fixing” no se qué…
Te adjunto el Log:
Fix result of Farbar Recovery Scan Tool (x64) Version: 30-06-2019
Ran by Absent (01-07-2019 12:53:53) Run:1
Running from C:\Users\Absent\Desktop
Loaded Profiles: Absent (Available Profiles: Absent)
Boot Mode: Normal
==============================================
fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-3126805088-1096401988-3500408547-1000\...\MountPoints2: {5bfb4346-0eb5-11e9-9c15-7824af4205d3} - "L:\setup.exe"
HKLM\...\Drivers32: [VIDC.RTV1] => C:\Windows\system32\rtvcvfw64.dll [246272 2012-09-28] () [File not signed]
HKLM\...\Drivers32: [vidc.i420] => C:\Windows\SysWOW64\i420vfw.dll [70656 2004-01-25] (www.helixcommunity.org) [File not signed]
HKLM\...\Drivers32: [VIDC.RTV1] => C:\Windows\SysWOW64\rtvcvfw32.dll [247296 2012-09-28] () [File not signed]
HKLM\...\Drivers32: [vidc.yv12] => C:\Windows\SysWOW64\yv12vfw.dll [70656 2004-01-25] (www.helixcommunity.org) [File not signed]
Task: {04FAB3A6-8FD2-46D2-96EF-C1608484FE41} - \Microsoft\Windows\Setup\EOSNotify -> No File <==== ATTENTION
Task: {706B5F1C-B5F8-4051-916F-4D1D0F4F1D66} - System32\Tasks\momag\{3EEBF4A5-6BD9-3528-1AD2-066A6C5B7D9E} => C:\Program Files (x86)\Common Files\3eebf4a56b\momag.exe
C:\Program Files (x86)\Common Files\3eebf4a56b
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131970613020950969&GUID=06F4EC48-6E91-4F5D-B415-C909D30B00DB
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131970613020953399&GUID=06F4EC48-6E91-4F5D-B415-C909D30B00DB
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3126805088-1096401988-3500408547-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
R1 e0357e2a3fca78a2; C:\WINDOWS\system32\drivers\e0357e2a3fca78a2.sys [30912 2019-06-21] (BlockChain Advances Ltd -> FsFilter Network)
U3 idsvc; no ImagePath
2019-06-21 18:55 - 2019-06-21 18:55 - 000030912 _____ (FsFilter Network) C:\WINDOWS\system32\Drivers\e0357e2a3fca78a2.sys
2019-06-21 18:54 - 2019-06-21 19:05 - 000000000 ____D C:\Program Files (x86)\gujhd
2019-06-21 18:54 - 2019-06-21 18:54 - 000000012 ___SH C:\WINDOWS\65612460883F
ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => -> No File
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No File
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files\Notepad++\NppShell_06.dll [2018-11-12] (Notepad++ -> )
ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File
ContextMenuHandlers1: [UAContextMenu] -> {A9B8E64D-3F7E-4D32-8FC9-E391DEE67D75} => -> No File
ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} => -> No File
ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => -> No File
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No File
ContextMenuHandlers5: [UAContextMenu] -> {A9B8E64D-3F7E-4D32-8FC9-E391DEE67D75} => -> No File
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File
ContextMenuHandlers6: [UAContextMenu] -> {A9B8E64D-3F7E-4D32-8FC9-E391DEE67D75} => -> No File
ContextMenuHandlers1_.DEFAULT: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => -> No File
ContextMenuHandlers4_.DEFAULT: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => -> No File
ContextMenuHandlers5_.DEFAULT: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => -> No File
AlternateDataStreams: C:\Users\Absent\Datos de programa:7dd1e1189f9fcf05a559dccee48d89c6 [362]
AlternateDataStreams: C:\Users\Absent\AppData\Roaming:7dd1e1189f9fcf05a559dccee48d89c6 [362]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [440]
HKLM\software\microsoft\Windows\CurrentVersion\Telephony\Providers => ProviderFileName2 -> ndptsp.tsp (No File)
HKU\S-1-5-21-3126805088-1096401988-3500408547-1000\...\StartupApproved\Run: => "ZUKR35S3BSTZNSD"
HKLM\...\StartupApproved\Run: => "WindowsDefender"
HKLM\...\StartupApproved\Run32: => "SecurityHealth"
CMD: ipconfig /flushdns
CMD: ipconfig /renew
CMD: bitsadmin /reset /allusers
CMD: netsh winsock reset
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
RemoveProxy:
EmptyTemp:
Hosts:
END
*****************
Processes closed successfully.
Restore point was successfully created.
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => removed successfully
HKU\S-1-5-21-3126805088-1096401988-3500408547-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5bfb4346-0eb5-11e9-9c15-7824af4205d3} => removed successfully
HKLM\Software\Classes\CLSID\{5bfb4346-0eb5-11e9-9c15-7824af4205d3} => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\\VIDC.RTV1" => removed successfully
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\\vidc.i420 => value restored successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\\VIDC.RTV1" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\\vidc.yv12" => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{04FAB3A6-8FD2-46D2-96EF-C1608484FE41}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{04FAB3A6-8FD2-46D2-96EF-C1608484FE41}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\EOSNotify" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{706B5F1C-B5F8-4051-916F-4D1D0F4F1D66}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{706B5F1C-B5F8-4051-916F-4D1D0F4F1D66}" => removed successfully
C:\WINDOWS\System32\Tasks\momag\{3EEBF4A5-6BD9-3528-1AD2-066A6C5B7D9E} => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\momag\{3EEBF4A5-6BD9-3528-1AD2-066A6C5B7D9E}" => removed successfully
"C:\Program Files (x86)\Common Files\3eebf4a56b" => not found
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => removed successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Local Page => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Local Page => value restored successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKU\S-1-5-21-3126805088-1096401988-3500408547-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
e0357e2a3fca78a2 => Unable to stop service.
HKLM\System\CurrentControlSet\Services\e0357e2a3fca78a2 => could not remove, key could be protected
HKLM\System\CurrentControlSet\Services\idsvc => removed successfully
idsvc => service removed successfully
Saludos!