А лог где, который после удаления создался?
Выполните скрипт в Farbar Recovery Scan Tool
Код:
start
CreateRestorePoint:
AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:07BF512B [136]
HKU\S-1-5-19\...\RunOnce: [Z-Del_Mini1] => cmd /c del /q /f "%userprofile%\Главное меню\Программы\Удаленный помощник.lnk"
HKU\S-1-5-19\...\RunOnce: [Z-Del_Mini3] => cmd /c reg add "hkcu\Software\Microsoft\Internet Explorer\Toolbar" /v LinksFolderName /f
HKU\S-1-5-19\...\RunOnce: [Z-Del_Mini4] => cmd /c reg add "hkcu\Software\Microsoft\Internet Explorer\Toolbar" /v Locked /t REG_DWORD /d 1 /f
HKU\S-1-5-20\...\RunOnce: [Z-Del_Mini1] => cmd /c del /q /f "%userprofile%\Главное меню\Программы\Удаленный помощник.lnk"
HKU\S-1-5-20\...\RunOnce: [Z-Del_Mini3] => cmd /c reg add "hkcu\Software\Microsoft\Internet Explorer\Toolbar" /v LinksFolderName /f
HKU\S-1-5-20\...\RunOnce: [Z-Del_Mini4] => cmd /c reg add "hkcu\Software\Microsoft\Internet Explorer\Toolbar" /v Locked /t REG_DWORD /d 1 /f
HKU\S-1-5-18\...\RunOnce: [Z-Del_Mini1] => cmd /c del /q /f "%userprofile%\Главное меню\Программы\Удаленный помощник.lnk"
HKU\S-1-5-18\...\RunOnce: [Z-Del_Mini3] => cmd /c reg add "hkcu\Software\Microsoft\Internet Explorer\Toolbar" /v LinksFolderName /f
HKU\S-1-5-18\...\RunOnce: [Z-Del_Mini4] => cmd /c reg add "hkcu\Software\Microsoft\Internet Explorer\Toolbar" /v Locked /t REG_DWORD /d 1 /f
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2052111302-1645522239-1606980848-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
CHR HKLM\...\Chrome\Extension: [bknbnapaddjdnbilpmlacdkjdkjmbjhd] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka
CHR HKLM\...\Chrome\Extension: [jeaohhlajejodfjadcponpnjgkiikocn] - <no Path\update_url>
CHR HKU\S-1-5-21-2052111302-1645522239-1606980848-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bknbnapaddjdnbilpmlacdkjdkjmbjhd] - hxxp://clients2.google.com/service/update2/crx
EmptyTemp:
Reboot:
end
