Do notatnika wklej i zapisz jako
fixlist.txt
Kod:
(AVG Secure Search) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\ToolbarUpdater.exe
() C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\loggingserver.exe
HKLM\...\AppCertDlls: [x64] -> c:\program files\movies toolbar\datamngr\x64\apcrtldr.dll <===== ATTENTION
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&a=irmsd0202ch&cd=2XzuyEtN2Y1L1QzutDtDtBtAyD0AtDzzyDtA0D0BzzyEyEzytN0D0Tzu0SyBzytAtN1L2XzutBtFtCyBtFtDtFtCtN1L1CzutDzytDtCtG1TtN1L1G1B1V1N2Y1L1Qzu2SyD0CtByEtAtDyCtCtGtCtCyC0EtG0DtAzz0BtG0Azz0F0FtGtDzy0Fzy0E0Bzz0F0DyB0A0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAyBtA0AyEyCtBtDtG0BtB0AzztGtDyDyD0EtG0C0B0E0DtGyCtDyE0FtAtB0D0Ezz0DyB0D2Q&cr=151098650&ir=
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&a=irmsd0202ch&cd=2XzuyEtN2Y1L1QzutDtDtBtAyD0AtDzzyDtA0D0BzzyEyEzytN0D0Tzu0SyBzytAtN1L2XzutBtFtCyBtFtDtFtCtN1L1CzutDzytDtCtG1TtN1L1G1B1V1N2Y1L1Qzu2SyD0CtByEtAtDyCtCtGtCtCyC0EtG0DtAzz0BtG0Azz0F0FtGtDzy0Fzy0E0Bzz0F0DyB0A0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAyBtA0AyEyCtBtDtG0BtB0AzztGtDyDyD0EtG0C0B0E0DtGyCtDyE0FtAtB0D0Ezz0DyB0D2Q&cr=151098650&ir=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
URLSearchHook: HKLM - gry Toolbar - {8532a8b7-c06a-41bb-936a-8ce73e4711ed} - C:\Program Files\gry\tbgry.dll (Conduit Ltd.)
URLSearchHook: HKLM - (No Name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} -No File
URLSearchHook: HKLM - Softonic-Polska_ Toolbar - {8f3c1d75-d467-43c2-9a36-655366b76f5f} - C:\Program Files\Softonic-Polska_\prxtbSoft.dll (Conduit Ltd.)
SearchScopes: HKLM - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=12&q={searchTerms}&barid={6E7CD7B4-659F-4715-9D00-21803D6A7FCA}
SearchScopes: HKLM - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =
SearchScopes: HKLM - {7EBB71AB-8281-4FAE-BD4D-DF209B9B7429} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEA;
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=350&systemid=406&v=n9092-97&apn_uid=9185520107204325&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031818
SearchScopes: HKLM - {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=12&q={searchTerms}&barid={6E7CD7B4-659F-4715-9D00-21803D6A7FCA}
SearchScopes: HKCU - DefaultScope {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd0202ch&cd=2XzuyEtN2Y1L1QzutDtDtBtAyD0AtDzzyDtA0D0BzzyEyEzytN0D0Tzu0SyBzytAtN1L2XzutBtFtCyBtFtDtFtCtN1L1CzutDzytDtCtG1TtN1L1G1B1V1N2Y1L1Qzu2StD0FtD0AtC0CyB0FtG0C0B0CzztGzy0D0EzytG0AtDzyzztGtByDyEyD0CtD0C0DyDtDyC0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAyBtA0AyEyCtBtDtG0BtB0AzztGtDyDyD0EtG0C0B0E0DtGyCtDyE0FtAtB0D0Ezz0DyB0D2Q&cr=288896170&ir=
SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKCU - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd0202ch&cd=2XzuyEtN2Y1L1QzutDtDtBtAyD0AtDzzyDtA0D0BzzyEyEzytN0D0Tzu0SyBzytAtN1L2XzutBtFtCyBtFtDtFtCtN1L1CzutDzytDtCtG1TtN1L1G1B1V1N2Y1L1Qzu2StD0FtD0AtC0CyB0FtG0C0B0CzztGzy0D0EzytG0AtDzyzztGtByDyEyD0CtD0C0DyDtDyC0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAyBtA0AyEyCtBtDtG0BtB0AzztGtDyDyD0EtG0C0B0E0DtGyCtDyE0FtAtB0D0Ezz0DyB0D2Q&cr=288896170&ir=
SearchScopes: HKCU - {7EBB71AB-8281-4FAE-BD4D-DF209B9B7429} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEA;
SearchScopes: HKCU - {96bd48dd-741b-41ae-ac4a-aff96ba00f7e} URL = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd0202ch&cd=2XzuyEtN2Y1L1QzutDtDtBtAyD0AtDzzyDtA0D0BzzyEyEzytN0D0Tzu0SyBzytAtN1L2XzutBtFtCyBtFtDtFtCtN1L1CzutDzytDtCtG1TtN1L1G1B1V1N2Y1L1Qzu2SyD0CtByEtAtDyCtCtGtCtCyC0EtG0DtAzz0BtG0Azz0F0FtGtDzy0Fzy0E0Bzz0F0DyB0A0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAyBtA0AyEyCtBtDtG0BtB0AzztGtDyDyD0EtG0C0B0E0DtGyCtDyE0FtAtB0D0Ezz0DyB0D2Q&cr=151098650&ir=
BHO: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} -No File
BHO: Plus-HD-2.3 - {11111111-1111-1111-1111-110311341126} -No File
BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} -No File
BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
BHO: CescrtHlpr Object - {64182481-4F71-486b-A045-B233BD0DA8FC} -No File
BHO: Bcool Class - {785540FD-AC76-E09C-2227-0AD1291925BF} - C:\ProgramData\Bcool\507c564fa9c17.ocx ()
BHO: gry Toolbar - {8532a8b7-c06a-41bb-936a-8ce73e4711ed} - C:\Program Files\gry\tbgry.dll (Conduit Ltd.)
BHO: Softonic-Polska_ Toolbar - {8f3c1d75-d467-43c2-9a36-655366b76f5f} - C:\Program Files\Softonic-Polska_\prxtbSoft.dll (Conduit Ltd.)
BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll (AVG Secure Search)
BHO: SweetPacks Browser Helper - {EEE6C35C-6118-11DC-9C72-001320C79847} -No File
BHO: SMTTB2009 Class - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} -No File
Toolbar: HKLM - pdfMachine - {56CF4856-ECB4-4e46-A897-A378821F97B9} - C:\Windows\system32\bgstb.dll (Broadgun Software)
Toolbar: HKLM - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
Toolbar: HKLM - gry Toolbar - {8532a8b7-c06a-41bb-936a-8ce73e4711ed} - C:\Program Files\gry\tbgry.dll (Conduit Ltd.)
Toolbar: HKLM - No Name - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} -No File
Toolbar: HKLM - Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
Toolbar: HKLM - Softonic-Polska_ Toolbar - {8f3c1d75-d467-43c2-9a36-655366b76f5f} - C:\Program Files\Softonic-Polska_\prxtbSoft.dll (Conduit Ltd.)
Toolbar: HKLM - facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} -No File
Toolbar: HKLM - Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} -No File
Toolbar: HKLM - SweetPacks Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} -No File
Toolbar: HKLM - DealBulldog Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} -No File
Toolbar: HKLM - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll (AVG Secure Search)
Toolbar: HKCU - gry Toolbar - {8532A8B7-C06A-41BB-936A-8CE73E4711ED} - C:\Program Files\gry\tbgry.dll (Conduit Ltd.)
Toolbar: HKCU - Softonic-Polska_ Toolbar - {8F3C1D75-D467-43C2-9A36-655366B76F5F} - C:\Program Files\Softonic-Polska_\prxtbSoft.dll (Conduit Ltd.)
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -No File
Toolbar: HKCU - DealBulldog Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} -No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -No File
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx
CHR HKLM\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\18.1.0.443\avg.crx [2014-04-28]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
R2 vToolbarUpdater18.1.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\ToolbarUpdater.exe [1801240 2014-04-28] (AVG Secure Search)
S3 ApfiltrService; system32\DRIVERS\Apfiltr.sys [X]
S3 EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys [X]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 tosporte; system32\DRIVERS\tosporte.sys [X]
S3 tosrfbd; system32\DRIVERS\tosrfbd.sys [X]
S3 tosrfbnp; System32\Drivers\tosrfbnp.sys [X]
S3 Tosrfcom; System32\Drivers\tosrfcom.sys [X]
S3 Tosrfhid; system32\DRIVERS\Tosrfhid.sys [X]
S3 tosrfnds; system32\DRIVERS\tosrfnds.sys [X]
S3 TosRfSnd; system32\drivers\tosrfsnd.sys [X]
S3 Tosrfusb; system32\DRIVERS\tosrfusb.sys [X]
S3 TpChoice; system32\DRIVERS\TpChoice.sys [X]
C:\ProgramData\AVG Secure Search
C:\Edgard
C:\Program Files\BonanzaDeals
C:\Users\Filip\AppData\Local\Temp\deinstal.exe
Task: {0AF1F1DD-8B42-4ADA-9EE1-78CA9F9ABA97} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{1D3039BD-8EE7-451E-B389-36A9AEC183F5}.exe
Task: {15055899-0DAB-412C-B113-78348C3E98B8} - System32\Tasks\MySearchDial => C:\Users\Filip\AppData\Roaming\mysearchdial\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {27A37345-AAC3-4513-B73B-415D7705236F} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv => C:\Windows\TEMP\{75AD51A6-D0B7-4A10-8889-22BDDDC8B16A}.exe
Task: {29C6DAE4-54C1-400D-BCEF-E949AB26B0F8} - System32\Tasks\{E777ADA9-37CA-4C3C-909B-446647F46384} => Chrome.exe http://ui.skype.com/ui/0/6.6.0.106/pl/abandoninstall?page=tsBing
Task: {48261B82-48AB-4CE4-A645-8B9D118CC446} - System32\Tasks\OptimizerPro1UpdaterTask{8DBD7835-9B30-4F5C-849D-33C2AC3CC046} => C:\ProgramData\Premium\OptimizerPro1\OptimizerPro1.exe <==== ATTENTION
Task: {4E3D18B3-5908-4FE6-8B61-0E9C490D3215} - System32\Tasks\SaveSenseLiveUpdateTaskMachineUA => C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: {54C5663B-1D86-48AC-AADE-B1E733B94E26} - System32\Tasks\SaveSenseLiveUpdateTaskMachineCore => C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: {86D25A3D-AFEE-4327-9D1B-B6A6C3F45617} - System32\Tasks\{D3DA3456-2B53-46ED-8F9F-8B251C2127C0} => C:\Program Files\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {B0A45AB2-130E-4FA7-B536-9FA55F6EAAFC} - System32\Tasks\SaveSense => C:\Users\Filip\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job => C:\Windows\TEMP\{75AD51A6-D0B7-4A10-8889-22BDDDC8B16A}.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{1D3039BD-8EE7-451E-B389-36A9AEC183F5}.exe
Task: C:\Windows\Tasks\MySearchDial.job => C:\Users\Filip\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\OptimizerPro1UpdaterTask{8DBD7835-9B30-4F5C-849D-33C2AC3CC046}.job => C:\ProgramData\Premium\OptimizerPro1\OptimizerPro1.exe <==== ATTENTION
Task: C:\Windows\Tasks\SaveSense.job => C:\Users\Filip\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job => C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job => C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:671329E4
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
Zapisany skrypt umieść obok ściągniętego programu
FRST
Następnie w programie kliknij
Fix ,po wykonaniu pokaż raport z tego działania.
Odinstaluj:
Akamai NetSession Interface Service
AVG Security Toolbar
Conduit Engine
DAEMON Tools Toolbar
gry Toolbar
Internet Explorer Toolbar 4.6 by SweetPacks
Softonic-Polska_ Toolbar
SweetIM for Messenger 3.7
W przeglądarce firefox -menu Pomoc > Informacje dla pomocy technicznej > Zresetuj program Firefox. Reset nie naruszy zakładek i haseł.
W Google Chrome
Ustawienia > karta Ustawienia > Po uruchomieniu > usuń adres jeśli widocznystart.mysearchdial.com, przestaw na "Otwórz stronę nowej karty"
Ustawienia > karta Rozszerzenia > odinstaluj AVG Security Toolbar
Ustawienia > karta Ustawienia > Pokaż ustawienia zaawansowane > zjedź na sam spód i uruchom opcję "Zresetuj ustawienia przeglądarki".
Ustawienia > karta Historia > wyczyść
Ściągnij program
[Aby zobaczyć linki, zarejestruj się tutaj]
kliknij
Szukaji następnie
Usuń
pokaż raport
Wklej na stronę raport z
SecurityCheck
[Aby zobaczyć linki, zarejestruj się tutaj]
Uruchom kliknij w dowolny klawisz,poczekaj aż program zakończy działanie.
Zrób ponownie skan FRST+OTL i podaj logi.