1) Odinstaluj te programy:
Cheapster for Firefox (HKLM-x32\...\Cheapster_FF) (Version: 1.0.0.915 - Koyote-Lab inc) <==== ATTENTION
iLivid (HKU\S-1-5-21-3320682542-3989286545-1332107319-1000\...\iLivid) (Version: 5.0.2.4762 - Bandoo Media Inc) <==== ATTENTION
RegClean-Pro (HKLM-x32\...\RegClean-Pro_is1) (Version: 6.21 - systweak.com) <==== ATTENTION
Solution Real (HKLM\...\Solution Real) (Version: 2015.01.13.152325 - Solution Real) <==== ATTENTION!
sweet-page uninstall (HKLM-x32\...\sweet-page uninstall) (Version: - sweet-page) <==== ATTENTION
2) Dałem link do Adw-Cleaner, więc go użyj
najpierw kliknij na SZUKAJ, a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ, to kliknij na niego.
Pokaż raport z niego C:\AdwCleaner\AdwCleaner[S].txt
3)
Otwórz Notatnik i wklej w nim:
C:\ProgramData\NCH Software
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro
C:\Program Files (x86)\RCP
C:\Windows\Tasks\RegClean Pro_DEFAULT.job
C:\ProgramData\ddc24aa9-6c5d-44d0-8c40-9bed83bb2ab7
C:\Windows\Tasks\RegClean Pro_UPDATES.job
C:\ProgramData\AVG Secure Search
C:\Users\Public\Desktop\RegClean Pro.lnk
C:\Program Files (x86)\Solution Real
C:\Windows\system32\Drivers\{693a0a5b-aa08-4a3c-b7e8-398a93e02cf2}Gw64.sys
C:\Users\Marcel\AppData\Local\Torch
C:\Windows\System32\Tasks\RegClean Pro
R1 {693a0a5b-aa08-4a3c-b7e8-398a93e02cf2}Gw64; C:\Windows\System32\drivers\{693a0a5b-aa08-4a3c-b7e8-398a93e02cf2}Gw64.sys [48792 2015-01-13] (StdLib)
S2 Update BrowseStudio; "C:\Program Files (x86)\BrowseStudio\updateBrowseStudio.exe" [X]
R2 Update Solution Real; C:\Program Files (x86)\Solution Real\updateSolutionReal.exe [529656 2015-01-15] ()
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - No Path
R2 Util Solution Real; C:\Program Files (x86)\Solution Real\bin\utilSolutionReal.exe [529656 2015-01-15] ()
CHR HKLM-x32\...\Chrome\Extension: [mahgaopgbalgbfohkikbdjfmaapiehaf] - C:\Users\Marcel\AppData\Local\CRE\mahgaopgbalgbfohkikbdjfmaapiehaf.crx
R2 vToolbarUpdater18.2.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.2.0\ToolbarUpdater.exe [1850392 2014-12-04] (AVG Secure Search)
CHR HKU\S-1-5-21-3320682542-3989286545-1332107319-1000\...\Chrome\Extension: [mahgaopgbalgbfohkikbdjfmaapiehaf] - C:\Users\Marcel\AppData\Local\CRE\mahgaopgbalgbfohkikbdjfmaapiehaf.crx [2014-10-15]
CHR Extension: (Solution Real) - C:\Users\Marcel\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipamelmmobjblnmppibneeackcpnldkc [2015-01-14]
CHR DefaultSearchKeyword: Default -> sweet-page
CHR StartupUrls: Default -> "hxxp://www.sweet-page.com/?type=hp&ts=1415196709&from=cor&uid=ST1000LM024XHN-M101MBB_S2SMJ9BD814653"
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Marcel\AppData\Roaming\Mozilla\Firefox\Profiles\k9bsj546.default\extensions\faststartff@gmail.com
FF Extension: Solution Real 1.0.1 - C:\Users\Marcel\AppData\Roaming\Mozilla\Firefox\Profiles\k9bsj546.default\Extensions\{693a0a5b-aa08-4a3c-b7e8-398a93e02cf2}.xpi [2015-01-13]
FF Extension: Fast Start - C:\Users\Marcel\AppData\Roaming\Mozilla\Firefox\Profiles\k9bsj546.default\Extensions\faststartff@gmail.com [2014-11-05]
FF Extension: AVG Web TuneUp - C:\Users\Marcel\AppData\Roaming\Mozilla\Firefox\Profiles\k9bsj546.default\Extensions\avg@toolbar [2014-11-12]
FF SearchPlugin: C:\Users\Marcel\AppData\Roaming\Mozilla\Firefox\Profiles\k9bsj546.default\searchplugins\avg-secure-search.xml
C:\Program Files (x86)\Common Files\AVG Secure Search
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\sweet-page.xml
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.2.0\\npsitesafety.dll No File
FF Homepage: https://mysearch.avg.com?cid={9B9459E4-C47F-438F-AC3B-2E285C8D1431}&mid=b8e9d0875b0847d2aa78dd9bd4baf2d8-e983f3a2f4b3049653f3a6ff0f3c7b5cf6c292fe&lang=pl&ds=AVG&coid=avgtbavg&cmpid=1214tb&pr=fr&d=2014-11-12 18:22:34&v=4.0.5.6&pid=wtu&sg=&sap=hp
BHO-x32: Solution Real 1.0.0.6 -> {1bb456da-878f-44a5-b013-4bfe0ae02fce} -> C:\Program Files (x86)\Solution Real\SolutionRealbho.dll No File
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
C:\Program Files (x86)\Solution Real
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
BHO-x32: BrowseStudio -> {1e9e0e98-4ab7-40b0-a0ce-69105c1b7c92} -> C:\Program Files (x86)\BrowseStudio\BrowseStudiobho.dll No File
Task: {1397CFC1-F01F-4084-AAAF-67BF4FBAB771} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RCP\RegCleanPro.exe [2014-12-08] () <==== ATTENTION
Task: {35F452F3-4383-4E14-AF5C-66AF788D793B} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RCP\RegCleanPro.exe [2014-12-08] () <==== ATTENTION
HKU\S-1-5-21-3320682542-3989286545-1332107319-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1415196709&from=cor&uid=ST1000LM024XHN-M101MBB_S2SMJ9BD814653
Task: {C0653DCE-B1CA-4271-AA53-C0DDD98BB4A8} - System32\Tasks\{6A29B5E1-933C-4091-8421-07F5C51C0346} => C:\Users\Marcel\AppData\Local\iLivid\iLivid.exe
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.sweet-page.com/?type=sc&ts=1415196709&from=cor&uid=ST1000LM024XHN-M101MBB_S2SMJ9BD814653
Task: {DE8EDBF2-0F68-401F-9530-40F3CFA22345} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RCP\RegCleanPro.exe [2014-12-08] () <==== ATTENTION
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1415196709&from=cor&uid=ST1000LM024XHN-M101MBB_S2SMJ9BD814653&q={searchTerms}
Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files (x86)\RCP\RegCleanPro.exe <==== ATTENTION
Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => C:\Program Files (x86)\RCP\RegCleanPro.exe <==== ATTENTION
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1415196709&from=cor&uid=ST1000LM024XHN-M101MBB_S2SMJ9BD814653&q={searchTerms}
C:\Program Files (x86)\Solution Real
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1415196709&from=cor&uid=ST1000LM024XHN-M101MBB_S2SMJ9BD814653&q={searchTerms}
AlternateDataStreams: C:\Windows:DB0E9AAFC45BD799
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1415196709&from=cor&uid=ST1000LM024XHN-M101MBB_S2SMJ9BD814653&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3320682542-3989286545-1332107319-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1415196709&from=cor&uid=ST1000LM024XHN-M101MBB_S2SMJ9BD814653&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3320682542-3989286545-1332107319-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={9B9459E4-C47F-438F-AC3B-2E285C8D1431}&mid=b8e9d0875b0847d2aa78dd9bd4baf2d8-e983f3a2f4b3049653f3a6ff0f3c7b5cf6c292fe&lang=pl&ds=AVG&coid=avgtbavg&cmpid=1214tb&pr=fr&d=2014-11-12 18:22:34&v=4.0.5.6&pid=wtu&sg=&sap=dsp&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1415196709&from=cor&uid=ST1000LM024XHN-M101MBB_S2SMJ9BD814653&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1415196709&from=cor&uid=ST1000LM024XHN-M101MBB_S2SMJ9BD814653&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1415196709&from=cor&uid=ST1000LM024XHN-M101MBB_S2SMJ9BD814653
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1415196709&from=cor&uid=ST1000LM024XHN-M101MBB_S2SMJ9BD814653
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1415196709&from=cor&uid=ST1000LM024XHN-M101MBB_S2SMJ9BD814653&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1415196709&from=cor&uid=ST1000LM024XHN-M101MBB_S2SMJ9BD814653&q={searchTerms}
EmptyTemp:
Plik zapisz pod nazwą
fixlist.txt i umieść obok
FRST. Uruchom
FRST i kliknij przycisk
Fix.
Powstanie plik fixlog.txt.
Daj ten log.
4) Zrób nowe logi FRST.
5) Napisz, czy problem znikł?
.
Użytkownik ordynat edytował ten post 15 01 2015 - 21:15