UKASH - mam i ja

vmontella · 10 Lipiec 2012 09:33

Tak więc i ja proszę o pomoc z tym dziadostwem.

Logi:

OTL - http://www.wklej.org/hash/5cb4296c395/

Extras - http://wklej.org/hash/bd3e9d2d7f7/

incognito19 · 10 Lipiec 2012 09:55

Odinstaluj:

DAEMON Tools

Conduit engine

Ask Toolbar

Uruchom OTL i w sekcji (Własne opcje skanowania/Skrypt)wklej

:OTL DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkflt.sys – (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp) DRV - File not found [Kernel | On_Demand | Unknown] – -- (a8ke7p1f) O2 - BHO: (SMTTB2009 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Mobile Media Converter Toolbar\tbcore3.dll () O3 - HKLM…\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM…\Toolbar: (Mobile Media Converter Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files\Mobile Media Converter Toolbar\tbcore3.dll () O3 - HKU\S-1-5-21-364123679-2636133995-942452982-1000…\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKU\S-1-5-21-364123679-2636133995-942452982-1000…\Toolbar\WebBrowser: (Mobile Media Converter Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files\Mobile Media Converter Toolbar\tbcore3.dll () O4 - HKLM…\Run: [] File not found O4 - HKU\S-1-5-21-364123679-2636133995-942452982-1000…\Run: [Facebook Update] C:\Users\k\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.) O4 - HKU\S-1-5-21-364123679-2636133995-942452982-1000…\Run: [king_mg] C:\Windows\system32\mgking.exe File not found O4 - HKU\S-1-5-21-364123679-2636133995-942452982-1000…\Run: [sNTSearch] C:\Users\k\AppData\Local\Microsoft\Windows\3579\SNTSearch.exe () O4 - HKU\S-1-5-21-364123679-2636133995-942452982-1000…\Run: [Vidalia] “C:\Program Files\Vidalia Exit Bundle\Vidalia\vidalia.exe” File not found O4 - Startup: C:\Users\k\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wwwzuc32.exe () F3 - HKU\S-1-5-21-364123679-2636133995-942452982-1000 WinNT: Load - (C:\Users\k\AppData\Local\Temp{59269~1.EXE) - C:\Users\k\AppData\Local\Temp{59269~1.EXE () :Files C:\Users\k\AppData\Local\Microsoft\Windows\3579 C:\Users\k\AppData\Roaming\hellomoto C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-364123679-2636133995-942452982-1000UA.job C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-364123679-2636133995-942452982-1000Core.job C:\Users\k\AppData\Roaming\qvjsge.dat C:\Users\k\AppData\Roaming\avdrn.dat C:\Windows\hpoins46.dat.temp C:\Windows\hpomdl46.dat.temp C:\Windows\hpoins46.dat :Commands [emptytemp]

Kliknij Wykonaj skrypt.Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, i kliknij skanuj.

Pokaż nowy log OTL.txt oraz raporty z usuwania.

vmontella · 10 Lipiec 2012 10:52

Okej, sprawa wygląda tak, że przez tryb awaryjny z poleceniami uruchomiłem panel sterowania dodaj/usuń programy (control appwiz.cpl) i odinstalowałem tego deamona. Nigdzie za to nie miałem możliwości odinstalowania Conduit engine i Ask Toolbar więc zrobiłem ppm -> usuń co pewnie całej sprawy nie załatwia, ale lepszego pomysłu nie miałem.

Po restarcie mam takie coś: http://wklej.org/id/787656/

Nowy log OTL: http://wklej.org/id/787660/

incognito19 · 10 Lipiec 2012 11:25

Uruchom OTL i w sekcji (Własne opcje skanowania/Skrypt)wklej

:Reg [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2] :OTL IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=2&cf=b3f4c9b0- … 1377ac8607 IE - HKLM…\URLSearchHook: {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - C:\Program Files\Free_Lunch_Design\prxtbFree.dll (Conduit Ltd.) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= … =CT1708250 IE - HKLM…\SearchScopes{6BFD347B-CBC6-4EA2-AEF3-55488BCC1BB9}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1708250 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= … =CT1708250 IE - HKCU…\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - SOFTWARE\Classes\CLSID{00000000-6E41-4FD3-8538-502F5495E5FC}\InprocServer32 File not found IE - HKCU…\URLSearchHook: {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - C:\Program Files\Free_Lunch_Design\prxtbFree.dll (Conduit Ltd.) IE - HKCU…\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files\Mobile Media Converter Toolbar\tbhelper.dll () IE - HKCU…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=14797 IE - HKCU…\SearchScopes{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: “URL” = http://websearch.ask.com/redirect?clien … src=crm&q={searchTerms}&locale=en_DE&apn_ptnrs=V9&apn_dtid=YYYYYYYYDE&apn_uid=40BB6FAF-DF82-4BBE-9493-0EA2B5131F87&apn_sauid=0615354C-5FE6-49E8-913D-DA347B7B547C IE - HKCU…\SearchScopes{6BFD347B-CBC6-4EA2-AEF3-55488BCC1BB9}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1708250 IE - HKCU…\SearchScopes{79A0003E-10AD-4F8C-9E73-065062C7FB80}: “URL” = http://search.yahoo.com/search?fr=chr-g … =382950&p={searchTerms} IE - HKCU…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://startsear.ch/?aff=2&src=sp&cf=b3 … 7ac8607&q={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: “ProxyOverride” = *.local FF - prefs.js…browser.search.defaultengine: “Web Search” FF - prefs.js…browser.search.defaultenginename: “Web Search” FF - prefs.js…browser.search.defaultthis.engineName: “Free Lunch Design TB Customized Web Search” FF - prefs.js…browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT2670199&SearchSource=3&q={searchTerms}” FF - prefs.js…browser.search.order.1: “Ask.com” FF - prefs.js…browser.search.selectedEngine: “Free Lunch Design TB Customized Web Search” FF - prefs.js…browser.search.update: false FF - prefs.js…browser.search.useDBForOrder: true FF - prefs.js…browser.startup.homepage: “http://startsear.ch/?aff=2&cf=b3f4c9b0-67d3-11e1-817d-001377ac8607” FF - prefs.js…extensions.enabledItems: {a5ae8924-4036-420f-b7f6-a47e4b8f692e}:3.6.0.10 FF - prefs.js…extensions.enabledItems: {dd05fd3d-18df-4ce4-ae53-e795339c5f01}:1.21 FF - prefs.js…extensions.enabledItems: IplextoALL@ALLPlayer.org:0.1.0 FF - prefs.js…extensions.enabledItems: YouTubetoALL@ALLPlayer.org:0.7.0 FF - prefs.js…keyword.URL: “http://search.hotspotshield.com/g/results.php?c=s&q=” [2012-01-27 20:05:05 | 000,000,000 | —D | M] (No name found) – C:\Users\k\AppData\Roaming\mozilla\Firefox\Profiles\actbdc6s.default\extensions [2012-01-27 20:05:08 | 000,000,000 | —D | M] (@@toolbarname@@) – C:\Users\k\AppData\Roaming\mozilla\Firefox\Profiles\actbdc6s.default\extensions\toolbar@ask.com [2012-04-01 14:56:06 | 000,000,000 | —D | M] (No name found) – C:\Users\k\AppData\Roaming\mozilla\Firefox\Profiles\v5li3fsi.default\extensions [2012-02-04 16:37:41 | 000,000,000 | —D | M] (Free Lunch Design TB Community Toolbar) – C:\Users\k\AppData\Roaming\mozilla\Firefox\Profiles\v5li3fsi.default\extensions{a5ae8924-4036-420f-b7f6-a47e4b8f692e} [2012-02-07 21:11:15 | 000,000,000 | —D | M] (vshare Add-On) – C:\Users\k\AppData\Roaming\mozilla\Firefox\Profiles\v5li3fsi.default\extensions{dd05fd3d-18df-4ce4-ae53-e795339c5f01} [2012-03-31 17:42:03 | 000,000,000 | —D | M] (Iplex to ALLPlayer) – C:\Users\k\AppData\Roaming\mozilla\Firefox\Profiles\v5li3fsi.default\extensions\IplextoALL@ALLPlayer.org [2012-03-31 17:42:20 | 000,000,000 | —D | M] (YouTube to ALLPlayer) – C:\Users\k\AppData\Roaming\mozilla\Firefox\Profiles\v5li3fsi.default\extensions\YouTubetoALL@ALLPlayer.org [2011-09-21 10:24:44 | 000,000,943 | ---- | M] () – C:\Users\k\AppData\Roaming\Mozilla\Firefox\Profiles\v5li3fsi.default\searchplugins\conduit.xml [2012-03-06 23:31:35 | 000,000,792 | ---- | M] () – C:\Users\k\AppData\Roaming\Mozilla\Firefox\Profiles\v5li3fsi.default\searchplugins\startsear.xml [2011-08-06 20:09:21 | 000,001,565 | ---- | M] () – C:\Users\k\AppData\Roaming\Mozilla\Firefox\Profiles\v5li3fsi.default\searchplugins\web-search.xml [2011-10-27 15:45:50 | 000,083,456 | ---- | M] (LiveVDO ) – C:\Program Files\mozilla firefox\plugins\npvsharetvplg.dll O2 - BHO: (Free Lunch Design Toolbar) - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - C:\Program Files\Free_Lunch_Design\prxtbFree.dll (Conduit Ltd.) O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files\StartSearch plugin\ssBarLcher.dll (StartSearch Inc.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found O3 - HKLM…\Toolbar: (Free Lunch Design Toolbar) - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - C:\Program Files\Free_Lunch_Design\prxtbFree.dll (Conduit Ltd.) O3 - HKLM…\Toolbar: (StartSearchToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files\StartSearch plugin\ssBarLcher.dll (StartSearch Inc.) O3 - HKLM…\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found O3 - HKCU…\Toolbar\WebBrowser: (Free Lunch Design Toolbar) - {57CC715D-37CA-44E4-9EC2-8C2CBDDB25EC} - C:\Program Files\Free_Lunch_Design\prxtbFree.dll (Conduit Ltd.) O3 - HKCU…\Toolbar\WebBrowser: (StartSearchToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files\StartSearch plugin\ssBarLcher.dll (StartSearch Inc.) O3 - HKCU…\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found O4 - HKLM…\Run: [ApnUpdater] “C:\Program Files\Ask.com\Updater\Updater.exe” File not found [2011-03-24 22:02:01 | 003,056,008 | ---- | C] (Ask) – C:\Program Files\Common Files\AskToolbarInstaller.exe [2010-01-18 01:33:43 | 000,000,000 | —D | M] – C:\Users\k\AppData\Roaming\DAEMON Tools :Commands [emptytemp]

Kliknij Wykonaj skrypt.Zatwierdź restart komputera.Uruchom OTL ponownie i użyj opcji sprzątanie.

Zastosuj AdwCleaner z opcji Delete.

http://general-changelog-team.fr/fr/dow … download/2

Napisz czy wszystko jest już dobrze.

vmontella · 10 Lipiec 2012 22:39

Dzięki, zrobiłem, niby było czysto, ale…

wyskoczyło po raz kolejny. Nie mam pojęcia skąd. Użyłem pierwszego skryptu i po włączeniu kompa wszystko jest ok, jak coś to zostawiam raport po restarcie:

http://wklej.org/id/788120/

i skan OTL: http://wklej.org/id/788123/

scripter1 · 12 Lipiec 2012 18:56

W skrypcie usuwania incognito19 niepotrzebnie dał do usunięcia dodatki do FF Iplex to ALLPlayer i Youtube to ALLPlayer, są one bezpieczne i niezbędne do poprawnego działania ALLplayera oraz aplikacji Youtube to ALLPlayer.

Oba dodatki są w pełni przetestowane przez mozillę i są na oficjalnej stronie dodatków:

https://addons.mozilla.org/addon/iplex-to-allplayer/

https://addons.mozilla.org/addon/youtube-to-allplayer/