snapdo i inne masakra

[sauro]

zaczelo sie ze pojawil sie program "snapdo" i z tego co rozumiem to on zaczal zapychac przegladarki wyszukiwarkami np search module.
logi z frst
shortcut http://www.wklej.eu/index.php?id=a7f750fc8a
addition http://www.wklej.eu/index.php?id=c3e92f80a7
frst http://www.wklej.eu/index.php?id=f58c88b02f

gmer http://www.wklej.eu/index.php?id=0c48080b35

staralem sie usunac co sie da z rejestru ale poddalem sie po 2 dniach walki. w przegladarce pojawia sie adress www-searching.com i nic nie moge z tym zrobic. probowalem 3 rozne przegladarki i w kazdej jest to samo. moze macie jakies pomysly gdzie to siedzi ;]

[mateo8898]

1. Odinstaluj Popcorn Time
2. Użyj AdwCleaner frst-otl-gmer-i-inne-poradnik-t13967-15.html#p139531 z opcji Usuń i podaj utworzony log.
3. Podaj nowe logi z FRST.

Kolejność jak podałem.

[sauro]

adwcleaner
http://www.wklej.eu/index.php?id=e680ba007a


frst
shortcuts
http://www.wklej.eu/index.php?id=2c88c7930a
addition
http://www.wklej.eu/index.php?id=dc056469bf
frst
http://www.wklej.eu/index.php?id=41d2a0895e

przegladarka niestety dalej mi wyswietla www-searching.com i nie idzie zmienic

[mateo8898]

W AdwCleaner Odinstaluj

Wklej do notatnika:

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) hxxp://www%2dsearching.com/?prd=set_epf&s=g59zamobl7428cc,f4c361b6-5461-4b7f-a6eb-dddc300f2bcf,
ShortcutWithArgument: C:\Users\ima\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) hxxp://www%2dsearching.com/?prd=set_epf&s=g59zamobl7428cc,f4c361b6-5461-4b7f-a6eb-dddc300f2bcf,
ShortcutWithArgument: C:\Users\ima\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) hxxp://www%2dsearching.com/?prd=set_epf&s=g59zamobl7428cc,f4c361b6-5461-4b7f-a6eb-dddc300f2bcf,
ShortcutWithArgument: C:\Users\ima\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) hxxp://www%2dsearching.com/?prd=set_epf&s=g59zamobl7428cc,f4c361b6-5461-4b7f-a6eb-dddc300f2bcf,
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) hxxp://www%2dsearching.com/?prd=set_epf&s=g59zamobl7428cc,f4c361b6-5461-4b7f-a6eb-dddc300f2bcf,
Task: {267767EF-C18A-4876-9A3C-CFE97B3D2FC8} - \Clusckghapele Monitor No File <==== ATTENTION
Task: {5F27B647-3A5D-487F-B811-1DC0D37CE0B8} - \Microsoft\Windows\Windows Activation Technologies\ValidationTask No File <==== ATTENTION
Task: {E9AC0CFF-EF39-4330-9FDF-11FDA3975CA4} - \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline No File <==== ATTENTION
Task: {F1A7F88B-3484-45DD-BD52-D17F8112D153} - System32\Tasks\Microsoft\Windows\SystemRestore\FreeVPN => C:\Users\ima\AppData\Roaming\FreeVPN\FreeVPN.exe <==== ATTENTION
C:\Users\ima\AppData\Roaming\FreeVPN
AppInit_DLLs: C:\ProgramData\Ronzap\Relatron.dll => No File
AppInit_DLLs-x32: C:\ProgramData\Ronzap\Trestech.dll => C:\ProgramData\Ronzap\Trestech.dll [257536 2016-05-09] ()
C:\ProgramData\Ronzap
HKU\S-1-5-21-544890793-3926228123-982414164-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGIjVkxlyIP4NYe17aVLWorQx0NJdBdrYAj_JlMffcrNazPNXJ6sunLD-NH_nMzuOlsr-mR6Nhio3c18S_II1_2EJEBWZdUDcFXOks8a7b_kNPvuEdZloziWcqA7ZSsO6PIJXSOu7alEgKW71vfz_h_XEkCFlTASNW1OMWMPh9MXHPPjPlpNRFWltTBX4&q={searchTerms}
HKU\S-1-5-21-544890793-3926228123-982414164-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGIjVkxlyIP4NYe17aVLWorQx0NJdBdrYAj_JlMffcrNazPNXJ6sunLD-NH_nMzuOlsr-mR6Nhio3c18S_II1_2EJEBWZdUDcFXOks8a7b_kNPvuEdZloziWcqA7ZSsO6PIJXSOu7alEgKW71vfz_h_XEkCFlTASNW1OMWMPh9MXHPPjPlpNRFWltTBX4&q={searchTerms}
HKU\S-1-5-21-544890793-3926228123-982414164-1000\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGIjVkxlyIP4NYe17aVLWorQx0NJdBdrYAj_JlMffcrNazPNXJ6sunLD-NH_nMzuOlsr-mR6Nhio3c18S_II1_2EJEBWZdUDcFXOks8a7b_kNPvuEdZloziWcqA7ZSsO6PIJXSOu7alEgKW71vfz_h_XEkCFlTASNW1OMWMPh9MXHPPjPlpNRFWltTBX4&q={searchTerms}
SearchScopes: HKU\S-1-5-21-544890793-3926228123-982414164-1000 {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3334580&octid=EB_ORIGINAL_CTID&ISID=MF80CBF59-DC7C-4A4D-8F70-17FFE2C3BE80&SearchSource=58&CUI=&UM=8&UP=SPF87E476E-4343-48FC-8AE0-5B938F146C96&D=050916&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-544890793-3926228123-982414164-1000 {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfVgMUwxFRwATbQAMUQBcFQcScBRaVwBADFZHJQtaVgFGGAMXdB9aFQQTSEcFME0FCFwEURNNfWpdAEsSSXhaF1BWBVYG&q={searchTerms}
SearchScopes: HKU\S-1-5-21-544890793-3926228123-982414164-1000 {48EB722C-4FFF-48DB-BD97-E521720C5CA6} URL = hxxp://www-searching.com/s.ashx?prd=opensearch&q={searchTerms}&s=G59zamobl7428CC,f4c361b6-5461-4b7f-a6eb-dddc300f2bcf,
SearchScopes: HKU\S-1-5-21-544890793-3926228123-982414164-1000 {9C51A58D-89D6-4A76-5BCB-8BF00D2B6E07} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGIjVkxlyIP4NYe17aVLWorQx0NJdBdrYAj_JlMffcrNazPNXJ6sunLD-NH_nMzuOlsr-mR6Nhio3c18S_II1_2EJEBWZdUDcFXOks8a7b_kNPvuEdZloziWcqA7ZSsO6PIJXSOu7alEgKW71vfz_h_XEkCFlTASNW1OMWMPh9MXHPPjPlpNRFWltTBX4&q={searchTerms}
SearchScopes: HKU\S-1-5-21-544890793-3926228123-982414164-1000 {F1A3A9D8-7564-4B5A-B047-29C87E658307} URL = hxxp://search.yahoo.com/yhs/search?hspart=ddc&hsimp=yhs-ddc_bd&type=bl-bir-dd__alt__ddc_dss_bd_com&p={searchTerms}
BHO-x32: Search My Window {4e31961d-e8c3-4ab0-9829-8e0f08f8dd01} C:\Program Files (x86)\Search My Window\Extensions\4e31961d-e8c3-4ab0-9829-8e0f08f8dd01.dll => No File
CHR RestoreOnStartup: ChromeDefaultData "hxxp://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRghCdAsNVV9EERgadAkBTA1DEAUOIg8BUBQSRVARIg4AVgBHFQEFIk0FA1oDB0VXfV5bFElXTwhwJVhKAlE8WGJKLl1XFg=="
CHR DefaultSearchURL: ChromeDefaultData hxxp://www-searching.com/search.aspx?s=G59zamobl7428CC,f4c361b6-5461-4b7f-a6eb-dddc300f2bcf,&prd=smw&q={searchTerms}
CHR DefaultSearchKeyword: ChromeDefaultData www-searching.com
CHR DefaultSuggestURL: ChromeDefaultData hxxp://api.searchpredict.com/api/?rqtype=ffplugin&siteID=8661&dbCode=1&command={searchTerms}
S2 Ronzap; no ImagePath
S3 ALSysIO; \??\C:\Users\ima\AppData\Local\Temp\ALSysIO64.sys [X]
2016-05-09 20:44 - 2016-05-09 20:44 - 06494208 _____ C:\Users\ima\AppData\Roaming\agent.dat
2016-05-09 20:44 - 2016-05-09 20:44 - 01626777 _____ C:\Users\ima\AppData\Roaming\Doublequadtax.tst
2016-05-09 20:44 - 2016-05-09 20:44 - 00948736 _____ C:\Users\ima\AppData\Roaming\Duofix.exe
2016-05-09 20:44 - 2016-05-09 20:44 - 00948736 _____ C:\Users\ima\AppData\Roaming\Doublequadtax.exe
2016-05-09 20:44 - 2016-05-09 20:44 - 00848437 _____ C:\Users\ima\AppData\Roaming\Zenstrong.bin
2016-05-09 20:44 - 2016-05-09 20:44 - 00189645 _____ () C:\Users\ima\AppData\Roaming\ConZap.bin
2016-05-09 20:44 - 2016-05-09 20:44 - 00127488 _____ C:\Users\ima\AppData\Roaming\Installer.dat
2016-05-09 20:44 - 2016-05-09 20:44 - 00126464 _____ C:\Users\ima\AppData\Roaming\noah.dat
2016-05-09 20:44 - 2016-05-09 20:44 - 00126464 _____ C:\Users\ima\AppData\Roaming\lobby.dat
2016-05-09 20:44 - 2016-05-09 20:44 - 00072717 _____ C:\Users\ima\AppData\Roaming\Duofix.tst
2016-05-09 20:44 - 2016-05-09 20:44 - 00065568 _____ C:\Users\ima\AppData\Roaming\Config.xml
2016-05-09 20:44 - 2016-05-09 20:44 - 00054272 _____ C:\Users\ima\AppData\Roaming\ApplicationHosting.dat
2016-05-09 20:44 - 2016-05-09 20:44 - 00018432 _____ C:\Users\ima\AppData\Roaming\Main.dat
2016-05-09 20:44 - 2016-05-09 20:44 - 00016992 _____ C:\Users\ima\AppData\Roaming\InstallationConfiguration.xml
2016-05-09 20:44 - 2016-05-09 20:44 - 00005568 _____ C:\Users\ima\AppData\Roaming\md.xml
2016-05-09 20:44 - 2016-05-09 20:44 - 00000000 ____D C:\ProgramData\Ronzaps
2016-05-09 19:45 - 2016-04-26 22:03 - 01253376 _____ (eee) C:\ProgramData\apptj.exe
C:\Program Files (x86)\Clusckghapele
C:\ProgramData\a.bat
C:\ProgramData\adb.exe
C:\ProgramData\apptj.exe
C:\ProgramData\fastboot.exe
EmptyTemp:

Plik zapisujesz pod nazwą fixlist.txt i umieszczasz obok FRST. Uruchom FRST i kliknij w nim Napraw. Powstanie plik fixlog.txt, który podajesz na forum.
Następnie podaj nowe logi z FRST.

[sauro]

fixlog http://www.wklej.eu/index.php?id=d5e8b1ff6b

frst shortcut
http://www.wklej.eu/index.php?id=4159c367a2
frst adition
http://www.wklej.eu/index.php?id=ed933976f2
frst
http://www.wklej.eu/index.php?id=5d4047efbf


przegladarke zresetowalo ale addblockan ie moge uzyc wiem ze addblock to zlo ale bez addblocka nie wytrzymam nerwowo stresujaca praca

[mateo8898]

wiem ze addblock to zlo ale bez addblocka nie wytrzymam nerwowo

A tam zło

Jak teraz wygląda sytuacja?

[sauro]

wszystko ok tyle ze addblok sie nei instaluje. chyba reinstalke chrome zrobie... tylko musze hasla pokopiowac i zakladki xD troche tego jest nie mialem czasu bo praca ;] jutro sie zabiore i napisze jak i co