Wirus - solution real usuwanie...

[10Aras10]

Witam mam problem z uciążliwymi reklamami z powodu solution real. Czy mógłbym prosić o pomoc w rozwiązaniu tego problemu ???

Moje logi:

http://wklej.org/id/1743974/ - Addition.txt
http://wklej.org/id/1743975/ - FRST.txt
http://wklej.org/id/1743977/ - Shortcut.txt


Liczę na pomoc i z góry dziękuję

[ordynat]

1) Odinstaluj te programy:

omiga-plus uninstall (HKLM-x32\...\omiga-plus uninstall) (Version: - omiga-plus) <==== ATTENTION
Solution Real (HKLM\...\Solution Real) (Version: 2015.01.06.072250 - Solution Real) <==== ATTENTION
YAC(Yet Another Cleaner!) (HKLM-x32\...\iSafe) (Version: - ELEX DO BRASIL cenzura!ÇÕES LTDA) <==== ATTENTION
Yahoo! Search (HKU\S-1-5-21-3550174935-1697132092-2298104627-1002\...\Yahoo! Search) (Version: - Pay-By-Ads) <==== ATTENTION

2) Użyj Adw-Cleaner http://www.programosy.pl/program,adwcleaner.html
najpierw kliknij na SZUKAJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ (CLEANING), to kliknij na niego.

3) Otwórz Notatnik i wklej w nim:

C:\Users\Arek\AppData\Local\Pay-By-Ads
C:\Program Files (x86)\Solution Real
Task: {768FC5B5-48A3-4D76-BD4F-B8001A82812B} - System32\Tasks\Yahoo! Search Updater => Wscript.exe //B "C:\Users\Arek\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.26.12\..\updt.js" <==== ATTENTION
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
C:\Program Files (x86)\Elex-tech
C:\ProgramData\WindowsMangerProtect
C:\Program Files (x86)\XTab
HKU\S-1-5-21-3550174935-1697132092-2298104627-1002\...\Run: [Yahoo! Search] => C:\Users\Arek\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.26.12\dsrlte.exe [660736 2015-06-03] (Pay By Ads LTD)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\WINDOWS\System32\Tasks\Yahoo! Search Updater
R1 {1d7d694e-604c-4da2-9100-b2601d3a1c57}w64; C:\Windows\System32\drivers\{1d7d694e-604c-4da2-9100-b2601d3a1c57}w64.sys [48792 2015-01-25] (StdLib)
R1 {29b8df85-56af-474f-9022-e376793679f9}Gw64; C:\Windows\System32\drivers\{29b8df85-56af-474f-9022-e376793679f9}Gw64.sys [48792 2015-01-05] (StdLib)
R1 {31c21995-b861-4864-ab50-4a53fbca73d4}Gw64; C:\Windows\System32\drivers\{31c21995-b861-4864-ab50-4a53fbca73d4}Gw64.sys [48784 2015-03-15] (StdLib)
R1 {31c21995-b861-4864-ab50-4a53fbca73d4}w64; C:\Windows\System32\drivers\{31c21995-b861-4864-ab50-4a53fbca73d4}w64.sys [48784 2015-02-03] (StdLib)
R1 {371bcf01-e691-44bf-9345-60788e5d16a5}w64; C:\Windows\System32\drivers\{371bcf01-e691-44bf-9345-60788e5d16a5}w64.sys [48792 2015-01-28] (StdLib)
R1 {693a0a5b-aa08-4a3c-b7e8-398a93e02cf2}w64; C:\Windows\System32\drivers\{693a0a5b-aa08-4a3c-b7e8-398a93e02cf2}w64.sys [48792 2015-01-13] (StdLib)
R1 {6e9af5d3-a8f9-4461-ad38-1433888f55dc}w64; C:\Windows\System32\drivers\{6e9af5d3-a8f9-4461-ad38-1433888f55dc}w64.sys [48792 2015-01-16] (StdLib)
R1 {76eaa25f-d535-414d-8a8b-4bce0a94d247}w64; C:\Windows\System32\drivers\{76eaa25f-d535-414d-8a8b-4bce0a94d247}w64.sys [48792 2015-01-10] (StdLib)
R1 {8d9c9462-4635-4cc0-ab2c-0e46af3a958b}Gw64; C:\Windows\System32\drivers\{8d9c9462-4635-4cc0-ab2c-0e46af3a958b}Gw64.sys [48792 2015-01-07] (StdLib)
R1 {8d9c9462-4635-4cc0-ab2c-0e46af3a958b}w64; C:\Windows\System32\drivers\{8d9c9462-4635-4cc0-ab2c-0e46af3a958b}w64.sys [48792 2015-01-07] (StdLib)
R1 {df8eec40-f909-439c-9ffe-3fee212f71b9}w64; C:\Windows\System32\drivers\{df8eec40-f909-439c-9ffe-3fee212f71b9}w64.sys [48784 2015-01-31] (StdLib)
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [260856 2015-05-13] (Elex do Brasil cenzura!ções Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [53568 2015-05-13] (Elex do Brasil cenzura!ções Ltda)
R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [108616 2015-05-13] (Elex do Brasil cenzura!ções Ltda)
R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [50944 2015-05-13] (Elex do Brasil cenzura!ções Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [102416 2015-05-13] (Elex do Brasil cenzura!ções Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [52392 2015-04-17] (Elex do Brasil cenzura!ções Ltda)
C:\Windows\System32\DRIVERS\iSafeNetFilter.sys
C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [602112 2015-05-20] (Windows SysTool) [File not signed] <==== ATTENTION
R2 Util Solution Real; C:\Program Files (x86)\Solution Real\bin\utilSolutionReal.exe [469744 2015-06-22] ()
R2 Update Solution Real; C:\Program Files (x86)\Solution Real\updateSolutionReal.exe [469744 2015-06-22] ()
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [118048 2015-05-13] (Elex do Brasil cenzura!ções Ltda)
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [157824 2015-05-20] (XTab system)
OPR Extension: (Solution Real) - C:\Users\Arek\AppData\Roaming\Opera Software\Opera Stable\Extensions\nongkkjjhbjloiienhkhphhjjlnlnbfe [2015-04-18]
FF HKLM-x32\...\Firefox\Extensions: [quick_searchff@gmail.com] - C:\Users\Arek\AppData\Roaming\Mozilla\Firefox\Profiles\lvn430o8.default\extensions\quick_searchff@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [sweetsearch@gmail.com] - C:\Users\Arek\AppData\Roaming\Mozilla\Firefox\Profiles\lvn430o8.default\extensions\sweetsearch@gmail.com
FF SearchPlugin: C:\Users\Arek\AppData\Roaming\Mozilla\Firefox\Profiles\lvn430o8.default\searchplugins\delta-homes.xml [2015-06-22]
FF SearchPlugin: C:\Users\Arek\AppData\Roaming\Mozilla\Firefox\Profiles\lvn430o8.default\searchplugins\search-simple.xml [2015-04-28]
FF Extension: QuickSearch - C:\Users\Arek\AppData\Roaming\Mozilla\Firefox\Profiles\lvn430o8.default\Extensions\quick_searchff@gmail.com [2015-05-21]
FF Extension: Search Enginer - C:\Users\Arek\AppData\Roaming\Mozilla\Firefox\Profiles\lvn430o8.default\Extensions\sweetsearch@gmail.com [2015-05-05]
FF Extension: Solution Real 1.0.1 - C:\Users\Arek\AppData\Roaming\Mozilla\Firefox\Profiles\lvn430o8.default\Extensions\{31c21995-b861-4864-ab50-4a53fbca73d4}.xpi [2015-04-28]
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: delta-homes
FF SelectedSearchEngine: delta-homes
FF Homepage: hxxp://www.delta-homes.com/?type=hp&ts=1432131231&z=9b88977b4ff0c748e2dcb64gfzec6o4g1ccg2oecbc&from=wpm05203&uid=TOSHIBAXMQ01ABD100_X3HJS1I9SXXX3HJS1I9S
FF Keyword.URL: hxxp://search.yahoo.com/yhs/search?hspart=ddc&hsimp=yhs-ddc_bd&type=pr__alt__ddc_dss_bd_com&p=
Toolbar: HKU\S-1-5-21-3550174935-1697132092-2298104627-1002 -> No Name - {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\XTab\SupTab.dll [2015-05-20] (Thinknice Co. Limited)
BHO-x32: LuckyTab Class -> {51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} -> C:\Program Files (x86)\XTab\SupTab.dll [2015-05-20] (Thinknice Co. Limited)
BHO-x32: Solution Real 1.0.0.7 -> {1bb456da-878f-44a5-b013-4bfe0ae02fce} -> C:\Program Files (x86)\Solution Real\SolutionRealBHO.dll No File
SearchScopes: HKLM -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL =
SearchScopes: HKLM-x32 -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://www.v9.com/web?type=ds&ts=1433408596&from=zzgbkk123&uid=toshibaxmq01abd100_x3hjs1i9sxxx3hjs1i9s&z=51b53ddaa83239383b6971dgez4cfcezce2b7w0t7b&q={searchTerms}
SearchScopes: HKLM-x32 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://www.v9.com/web?type=ds&ts=1433408596&from=zzgbkk123&uid=toshibaxmq01abd100_x3hjs1i9sxxx3hjs1i9s&z=51b53ddaa83239383b6971dgez4cfcezce2b7w0t7b&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3550174935-1697132092-2298104627-1001 -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://www.v9.com/web?type=ds&ts=1433408596&from=zzgbkk123&uid=toshibaxmq01abd100_x3hjs1i9sxxx3hjs1i9s&z=51b53ddaa83239383b6971dgez4cfcezce2b7w0t7b&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3550174935-1697132092-2298104627-1001 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://www.v9.com/web?type=ds&ts=1433408596&from=zzgbkk123&uid=toshibaxmq01abd100_x3hjs1i9sxxx3hjs1i9s&z=51b53ddaa83239383b6971dgez4cfcezce2b7w0t7b&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3550174935-1697132092-2298104627-1001 -> {78BFF71D-9DA2-4B27-ADC3-FD8DF4545CB8} URL = http://q.search-simple.com/?affID=pr_96b274a9-b126-4e1d-a3c7-62909e92ae87&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3550174935-1697132092-2298104627-1002 -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://www.v9.com/web?type=ds&ts=1433408596&from=zzgbkk123&uid=toshibaxmq01abd100_x3hjs1i9sxxx3hjs1i9s&z=51b53ddaa83239383b6971dgez4cfcezce2b7w0t7b&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3550174935-1697132092-2298104627-1002 -> OldSearch URL = http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3550174935-1697132092-2298104627-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3550174935-1697132092-2298104627-1002 -> {0E77005C-A48E-4C2B-BF2F-9A40FABEAD91} URL = http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3550174935-1697132092-2298104627-1002 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3550174935-1697132092-2298104627-1002 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3550174935-1697132092-2298104627-1002 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://www.v9.com/web?type=ds&ts=1433408596&from=zzgbkk123&uid=toshibaxmq01abd100_x3hjs1i9sxxx3hjs1i9s&z=51b53ddaa83239383b6971dgez4cfcezce2b7w0t7b&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3550174935-1697132092-2298104627-1002 -> {78BFF71D-9DA2-4B27-ADC3-FD8DF4545CB8} URL = http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3550174935-1697132092-2298104627-1002 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3550174935-1697132092-2298104627-1002 -> {szukaj.gazeta.pl} URL = http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
HKU\S-1-5-21-3550174935-1697132092-2298104627-1002\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1420545762&from=cor&uid=TOSHIBAXMQ01ABD100_X3HJS1I9SXXX3HJS1I9S&q={searchTerms}
HKU\S-1-5-21-3550174935-1697132092-2298104627-1002\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1420545762&from=cor&uid=TOSHIBAXMQ01ABD100_X3HJS1I9SXXX3HJS1I9S&q={searchTerms}
HKU\S-1-5-21-3550174935-1697132092-2298104627-1002\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?type=hp&ts=1432131231&z=9b88977b4ff0c748e2dcb64gfzec6o4g1ccg2oecbc&from=wpm05203&uid=TOSHIBAXMQ01ABD100_X3HJS1I9SXXX3HJS1I9S
HKU\S-1-5-21-3550174935-1697132092-2298104627-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?type=hp&ts=1432131231&z=9b88977b4ff0c748e2dcb64gfzec6o4g1ccg2oecbc&from=wpm05203&uid=TOSHIBAXMQ01ABD100_X3HJS1I9SXXX3HJS1I9S
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?type=hp&ts=1432131231&z=9b88977b4ff0c748e2dcb64gfzec6o4g1ccg2oecbc&from=wpm05203&uid=TOSHIBAXMQ01ABD100_X3HJS1I9SXXX3HJS1I9S
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?type=hp&ts=1432131231&z=9b88977b4ff0c748e2dcb64gfzec6o4g1ccg2oecbc&from=wpm05203&uid=TOSHIBAXMQ01ABD100_X3HJS1I9SXXX3HJS1I9S
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1420545762&from=cor&uid=TOSHIBAXMQ01ABD100_X3HJS1I9SXXX3HJS1I9S&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1420545762&from=cor&uid=TOSHIBAXMQ01ABD100_X3HJS1I9SXXX3HJS1I9S&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?type=hp&ts=1432131231&z=9b88977b4ff0c748e2dcb64gfzec6o4g1ccg2oecbc&from=wpm05203&uid=TOSHIBAXMQ01ABD100_X3HJS1I9SXXX3HJS1I9S
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?type=hp&ts=1432131231&z=9b88977b4ff0c748e2dcb64gfzec6o4g1ccg2oecbc&from=wpm05203&uid=TOSHIBAXMQ01ABD100_X3HJS1I9SXXX3HJS1I9S
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1420545762&from=cor&uid=TOSHIBAXMQ01ABD100_X3HJS1I9SXXX3HJS1I9S&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1420545762&from=cor&uid=TOSHIBAXMQ01ABD100_X3HJS1I9SXXX3HJS1I9S&q={searchTerms}
HKU\S-1-5-21-3550174935-1697132092-2298104627-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.yahoo.com/?fr=hp-ddc-bd&type=pr__alt__ddc_dsssyc_bd_com
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.


----------------------
Jeśli będzie OK, to będziemy kończyć:
Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix.
przez SHIFT+DEL usuń pozostały folder C:\FRST.

W Adw-Cleaner kliknij na przycisk Odinstaluj (UNINSTALL).

.
=================

Jeśli natomiast problem nie zniknie, to przeinstalujesz przeglądarkę, na której to jeszcze będzie.
.

[10Aras10]

Wielkie dzięki za odp Jak będę w domu to zaraz się tym zajmę i dam znać czy podziałało

[ordynat]

OK.

[10Aras10]

Superancko Na pierwszy rzut oka wszystko działa już bez zarzutu Wielkie Dzięki za pomoc