mac88
6 Listopad 2012 10:36
#1
Witam, wkradł mi się na dysk toolbar i wyszukiwarka http://search.certified-toolbar.com
Poniżej skany z OTL:
OTL -> http://www.wklej.eu/index.php?id=3968d1ce85
Extras -> http://www.wklej.eu/index.php?id=03773776eb
Acorus
6 Listopad 2012 12:09
#2
Użyj AdwCleaner http://general-changelog-team.fr/fr/dow … adwcleaner z funkcji Delete(w przypadku Visty/Windows7 uruchom z prawokliku jako Administrator).
Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:
:OTL IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.certified-toolbar.com?si= … bs=true&q= IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.certified-toolbar.com?si= … bs=true&q= IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.certified-toolbar.com?si= … bs=true&q= IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = http://search.certified-toolbar.com?si= … e&tid=2937 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.certified-toolbar.com?si= … e&tid=2937 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://search.certified-toolbar.com?si= … bs=true&q= IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://search.certified-toolbar.com?si= … bs=true&q= IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = http://search.certified-toolbar.com?si= … bs=true&q= IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Default_Page_URL = http://search.certified-toolbar.com?si= … e&tid=2937 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://search.certified-toolbar.com?si= … e&tid=2937 IE - HKLM…\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: “URL” = http://search.certified-toolbar.com?si= … id=2937&q={searchTerms} IE - HKLM…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://search.certified-toolbar.com?si= … id=2937&q={searchTerms} IE - HKU\S-1-5-21-4130104494-67612165-2441058627-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.certified-toolbar.com?si= … bs=true&q= IE - HKU\S-1-5-21-4130104494-67612165-2441058627-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.certified-toolbar.com?si= … bs=true&q= IE - HKU\S-1-5-21-4130104494-67612165-2441058627-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.certified-toolbar.com?si= … bs=true&q= IE - HKU\S-1-5-21-4130104494-67612165-2441058627-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = http://search.certified-toolbar.com?si= … e&tid=2937 IE - HKU\S-1-5-21-4130104494-67612165-2441058627-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.certified-toolbar.com?si= … e&tid=2937 IE - HKU\S-1-5-21-4130104494-67612165-2441058627-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://search.certified-toolbar.com?si= … bs=true&q= IE - HKU\S-1-5-21-4130104494-67612165-2441058627-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://search.certified-toolbar.com?si= … bs=true&q= IE - HKU\S-1-5-21-4130104494-67612165-2441058627-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = http://search.certified-toolbar.com?si= … bs=true&q= IE - HKU\S-1-5-21-4130104494-67612165-2441058627-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Start Default_Page_URL = http://search.certified-toolbar.com?si= … e&tid=2937 IE - HKU\S-1-5-21-4130104494-67612165-2441058627-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://search.certified-toolbar.com?si= … e&tid=2937 IE - HKU\S-1-5-21-4130104494-67612165-2441058627-1001…\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: “URL” = http://search.certified-toolbar.com?si= … id=2937&q={searchTerms} IE - HKU\S-1-5-21-4130104494-67612165-2441058627-1001…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://search.certified-toolbar.com?si= … id=2937&q={searchTerms} FF - prefs.js…browser.search.defaultengine: “Web Search” FF - prefs.js…browser.search.defaultenginename: “Web Search” FF - prefs.js…browser.search.order.1: “Web Search” FF - prefs.js…keyword.URL: “http://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q= ” [2012-11-01 00:08:09 | 000,003,269 | ---- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\Web Search.xml O4 - HKU\S-1-5-21-4130104494-67612165-2441058627-1001…\Run: [Facebook Update] C:\Users\Heniu\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.) O4 - HKU\S-1-5-21-4130104494-67612165-2441058627-1001…\Run: [sRSHDAudioLab] “C:\Program Files\SRS Labs\SRS Audio Essentials\AudioEssentials.exe” auto File not found O4 - HKU\S-1-5-19…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found [2012-11-05 21:24:01 | 000,000,928 | ---- | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-4130104494-67612165-2441058627-1001UA.job [2012-11-03 00:24:00 | 000,000,906 | ---- | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-4130104494-67612165-2441058627-1001Core.job :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [emptytemp]
Kliknij Wykonaj skrypt.W OTL użyj opcji Sprzątanie.
W AdwCleaner użyj opcji Uninstall.