Jak usunąć Speedial? Czy mój komputer jest zainfekowany?

[zuzanna]

Proszę o pomoc

OTL

http://www.wklej.eu/index.php?id=1595af41b9

Extras

http://www.wklej.eu/index.php?id=c50325127e

GMER

http://www.wklej.eu/index.php?id=b897615edc

[mateo8898]

Odinstaluj Bonjour

Użyj AdwCleaner otl-gmer-i-inne-poradnik-t13967-15.html#p139531 z opcji Usuń i podaj utworzony log.

Następnie podaj nowe logi z OTL.

[zuzanna]

AdwCleaner

http://www.wklej.eu/index.php?id=f502aadc50

OTL

http://www.wklej.eu/index.php?id=e5a8a04137

Extras

http://www.wklej.eu/index.php?id=74aed3b3c8

[mateo8898]

W AdwCleaner Odinstaluj

W ustawieniach Chrome zmień wyszukiwarkę oraz stronę startową na np. google.pl

Następnie:

Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

:OTL
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://speedial.com/?f=1&a=spd_ir_14_21_ff&cd=2XzuyEtN2Y1L1Qzu0CyEyEyCtCzytByB0F0A0DtCyC0CyE0DtN0D0Tzu0SzzyBtBtN1L2XzutBtFtBtDtFtCyDtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StA0DzzyEyE0FtBzztGyD0ByD0DtG0CtB0FyCtGzy0FtA0DtGyB0ByC0D0B0FyCyCyCyCtC0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDyByEyBtD0BtCtCtGyD0DyDtDtGtAtAzytBtGtB0EtByCtGyCyCyBtD0DtAtA0Fzz0EyEtC2Q&cr=595874287&ir=
IE:64bit: - HKLM\..\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}: "URL" = http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_ir_14_21_ff&cd=2XzuyEtN2Y1L1Qzu0CyEyEyCtCzytByB0F0A0DtCyC0CyE0DtN0D0Tzu0SzzyBtBtN1L2XzutBtFtBtDtFtCyDtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StA0DzzyEyE0FtBzztGyD0ByD0DtG0CtB0FyCtGzy0FtA0DtGyB0ByC0D0B0FyCyCyCyCtC0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDyByEyBtD0BtCtCtGyD0DyDtDtGtAtAzytBtGtB0EtByCtGyCyCyBtD0DtAtA0Fzz0EyEtC2Q&cr=595874287&ir=
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://speedial.com/?f=1&a=spd_ir_14_21_ff&cd=2XzuyEtN2Y1L1Qzu0CyEyEyCtCzytByB0F0A0DtCyC0CyE0DtN0D0Tzu0SzzyBtBtN1L2XzutBtFtBtDtFtCyDtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StA0DzzyEyE0FtBzztGyD0ByD0DtG0CtB0FyCtGzy0FtA0DtGyB0ByC0D0B0FyCyCyCyCtC0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDyByEyBtD0BtCtCtGyD0DyDtDtGtAtAzytBtGtB0EtByCtGyCyCyBtD0DtAtA0Fzz0EyEtC2Q&cr=595874287&ir=
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://search.chatzum.com/?q={searchTerms}
IE - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://speedial.com/?f=1&a=spd_ir_14_21_ff&cd=2XzuyEtN2Y1L1Qzu0CyEyEyCtCzytByB0F0A0DtCyC0CyE0DtN0D0Tzu0SzzyBtBtN1L2XzutBtFtBtDtFtCyDtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StA0DzzyEyE0FtBzztGyD0ByD0DtG0CtB0FyCtGzy0FtA0DtGyB0ByC0D0B0FyCyCyCyCtC0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDyByEyBtD0BtCtCtGyD0DyDtDtGtAtAzytBtGtB0EtByCtGyCyCyBtD0DtAtA0Fzz0EyEtC2Q&cr=595874287&ir=
IE - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\..\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}: "URL" = http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_ir_14_21_ff&cd=2XzuyEtN2Y1L1Qzu0CyEyEyCtCzytByB0F0A0DtCyC0CyE0DtN0D0Tzu0SzzyBtBtN1L2XzutBtFtBtDtFtCyDtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StA0DzzyEyE0FtBzztGyD0ByD0DtG0CtB0FyCtGzy0FtA0DtGyB0ByC0D0B0FyCyCyCyCtC0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDyByEyBtD0BtCtCtGyD0DyDtDtGtAtAzytBtGtB0EtByCtGyCyCyBtD0DtAtA0Fzz0EyEtC2Q&cr=595874287&ir=
IE - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\..\SearchScopes\{E616D537-7BE5-4871-93A3-44590080F566}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=7AE7B1DF-1BF2-4568-B89C-35DC68D5FA60&apn_sauid=20BFE2BC-B477-4733-8161-314DEFF112E1
FF - prefs.js..browser.search.defaultenginename: "Speedial"
FF - prefs.js..browser.search.selectedEngine: "Speedial"
FF - prefs.js..browser.startup.homepage: "http://speedial.com/?f=1&a=spd_ir_14_21_ff&cd=2XzuyEtN2Y1L1Qzu0CyEyEyCtCzytByB0F0A0DtCyC0CyE0DtN0D0Tzu0SzzyBtBtN1L2XzutBtFtBtDtFtCyDtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StA0DzzyEyE0FtBzztGyD0ByD0DtG0CtB0FyCtGzy0FtA0DtGyB0ByC0D0B0FyCyCyCyCtC0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDyByEyBtD0BtCtCtGyD0DyDtDtGtAtAzytBtGtB0EtByCtGyCyCyBtD0DtAtA0Fzz0EyEtC2Q&cr=595874287&ir="
[2014/05/21 19:27:15 | 000,000,000 | ---D | M] ("Speedial") -- C:\Users\arleta\AppData\Roaming\mozilla\Firefox\Profiles\am7441m7.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}
[2014/05/21 19:27:18 | 000,002,769 | ---- | M] () -- C:\Users\arleta\AppData\Roaming\mozilla\firefox\profiles\am7441m7.default\searchplugins\Speedial.xml
CHR - Extension: Speedial = C:\Users\arleta\AppData\Local\Google\Chrome\User Data\Default\Extensions\bakijjialdiiboeaknfpmflphhmljfkd\9.4.25_0\
O2 - BHO: (webget) - {dc264a72-fa75-4948-b881-ea8eff8e5dd2} - C:\Program Files (x86)\webget\webgetbho.dll File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
[2014/05/21 20:12:09 | 000,000,000 | ---D | C] -- C:\FRST

:Reg
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GG"=-
"IPLA!"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Corel Photo Downloader"=-
"DivXUpdate"=-
"NortonOnlineBackup"=-

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Podajesz log z usuwania + nowe logi z OTL.

[zuzanna]

05212014_230318 log z usuwania

http://www.wklej.eu/index.php?id=f0b1eb6f2b

OTL

http://www.wklej.eu/index.php?id=d310a9ea5e

Extras

http://www.wklej.eu/index.php?id=b0f015c497

[mateo8898]

Wklej w OTL:

:OTL
IE - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 156.17.125.123:3128
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

Klikasz Wykonaj skrypt i podajesz log z usuwania.

[zuzanna]

Log z usuwania

http://www.wklej.eu/index.php?id=460b54b7cb

[mateo8898]

W OTL Sprzątanie

Przeczyść dysk oraz rejestr CCleaner (zakładka Cleaner i Rejestr)

Zainstaluj http://www.instalki.pl/programy/downloa ... hecky.html

[zuzanna]

Dziękuję! Mogę się w jakiś sposób odwdzięczyc ?

[mateo8898]

Nie ma za co