Glass bottle - problem z usunieciem

**Posty:** 3 · przez **sywi** 18 Cze 2015, 23:52

Witam
Mam klopot z usunieciem adware - glass bottle wraz z jakims hotspot shield -gowno mi sie zainstalowalo wraz z zune chyba, zablokowalo mi mozliwosc sciagniecia adwcleanera, stopzilla nic nie pomogla, zrobilem skan frst wrzucam pliki i prosze o pomoc

**Posty:** 4765 · przez **ordynat** 19 Cze 2015, 07:35

1) SpyHunter - nie jest zaufanym programem.
Odinstaluj, ale w ten sposób:
kliknij na tę ikonkę C:\Users\nazwa Użytkownika\Start Menu\Programs\SpyHunter\Uninstall.lnk (czyli >>START >>Programy>>Spy Hunter>>Unnistal)
wyskoczy okienko, ale zamiast klikać wielki zielony guzik "continue" kliknij "no, thanks". To drugie odinstalowuje.

2)

WinRAR Packages (HKU\S-1-5-21-3936056900-723494085-1279694888-1000\...\WinRAR Packages) (Version: - ) <==== ATTENTION

Odinstaluj to "Winrar Packages" (programu "Winrar" nie ruszaj)

3)

z jakims hotspot shield

To jest ściśle związane z Twoim programem "Expat Shield" - więc go odinstaluj.

4) Otwórz Notatnik i wklej w nim:

FF Extension: Glass Bottle - C:\Users\Posos\AppData\Roaming\Mozilla\Firefox\Profiles\csy7wwro.default\Extensions\{6cc7b257-bb54-4f3f-828e-06e90d802dc5}.xpi [2015-06-04]
HKU\S-1-5-21-3936056900-723494085-1279694888-1000\...\Run: [Ckuouq] => C:\Users\Posos\AppData\Roaming\Ckuouq.scr
C:\Users\Posos\AppData\Roaming\Ckuouq.scr
Task: {7D50B552-80FA-46CB-993F-136A60619FC0} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{E778E085-7BAC-4348-8B02-399174083F6B}.exe
Task: {C1F3BC58-08D3-4A55-9EF2-5F443F5B3C79} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv => C:\Windows\TEMP\{A2B01594-D369-4238-8E54-52411DB43E8D}.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job => C:\Windows\TEMP\{A2B01594-D369-4238-8E54-52411DB43E8D}.exe <==== ATTENTION
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{E778E085-7BAC-4348-8B02-399174083F6B}.exe <==== ATTENTION
FF DefaultSearchEngine: do-search
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://do-search.com/?type=hppp&ts=1433417097&z=381d7e4eb0db9abf1c41984gaz8c7c5z8g4megbeag&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://do-search.com/web/?type=ds&ts=1433417049&z=5ae5d76d6ba20432d5cead4gez6c8c9z9g6m5e0w4c&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://do-search.com/?type=hppp&ts=1433417097&z=381d7e4eb0db9abf1c41984gaz8c7c5z8g4megbeag&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://do-search.com/web/?type=ds&ts=1433417049&z=5ae5d76d6ba20432d5cead4gez6c8c9z9g6m5e0w4c&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&q={searchTerms}
HKU\S-1-5-21-3936056900-723494085-1279694888-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://do-search.com/?type=hppp&ts=1433417097&z=381d7e4eb0db9abf1c41984gaz8c7c5z8g4megbeag&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393
HKU\S-1-5-21-3936056900-723494085-1279694888-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://do-search.com/web/?type=dspp&ts=1433417097&z=381d7e4eb0db9abf1c41984gaz8c7c5z8g4megbeag&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&q={searchTerms}
HKU\S-1-5-21-3936056900-723494085-1279694888-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://do-search.com/?type=hppp&ts=1433417097&z=381d7e4eb0db9abf1c41984gaz8c7c5z8g4megbeag&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393
HKU\S-1-5-21-3936056900-723494085-1279694888-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://do-search.com/web/?type=dspp&ts=1433417097&z=381d7e4eb0db9abf1c41984gaz8c7c5z8g4megbeag&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&q={searchTerms}
URLSearchHook: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 - (No Name) - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - No File
SearchScopes: HKLM -> {1519E322-5CAB-42A4-8A9A-F0DEA7EC5514} URL = http://uk.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913936
SearchScopes: HKLM -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2790392
SearchScopes: HKLM -> {B26EAD63-B6C8-4BC4-919E-2231470DDC79} URL = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1184&query={searchTerms}&invocationType=tb50hpcnnbie7-en-gb
SearchScopes: HKLM -> {BB55F193-4260-434D-8700-B1DE1EB3E00D} URL = http://uk.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913936
SearchScopes: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://do-search.com/web/?type=dspp&ts=1433417097&z=381d7e4eb0db9abf1c41984gaz8c7c5z8g4megbeag&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&ts=1433417130&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&ts=1433417130&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 -> {105E99FF-8B9A-4492-B155-06194B9056D2} URL = http://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&ts=1433417130&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 -> {1519E322-5CAB-42A4-8A9A-F0DEA7EC5514} URL = http://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&ts=1433417130&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = http://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&ts=1433417130&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&ts=1433417130&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://do-search.com/web/?type=dspp&ts=1433417097&z=381d7e4eb0db9abf1c41984gaz8c7c5z8g4megbeag&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&ts=1433417130&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 -> {B26EAD63-B6C8-4BC4-919E-2231470DDC79} URL = http://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&ts=1433417130&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 -> {BB55F193-4260-434D-8700-B1DE1EB3E00D} URL = http://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&ts=1433417130&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393&ts=1433417130&type=default&q={searchTerms}
Toolbar: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 -> No Name - {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No File
Toolbar: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKU\S-1-5-21-3936056900-723494085-1279694888-1000 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
DPF: {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
Winsock: Catalog5 01 mswsock.dll File not found ATTENTION: LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 02 mswsock.dll File not found ATTENTION: LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
FF Homepage: hxxp://do-search.com/?type=hppp&ts=1433417097&z=381d7e4eb0db9abf1c41984gaz8c7c5z8g4megbeag&from=cor&uid=SAMSUNGXHM160HI_S18PJD8Q216393
FF SearchPlugin: C:\Users\Posos\AppData\Roaming\Mozilla\Firefox\Profiles\csy7wwro.default\searchplugins\askcom.xml [2013-06-25]
FF SearchPlugin: C:\Users\Posos\AppData\Roaming\Mozilla\Firefox\Profiles\csy7wwro.default\searchplugins\babylon.xml [2013-06-16]
FF SearchPlugin: C:\Users\Posos\AppData\Roaming\Mozilla\Firefox\Profiles\csy7wwro.default\searchplugins\browsemngr.xml [2012-10-31]
FF SearchPlugin: C:\Users\Posos\AppData\Roaming\Mozilla\Firefox\Profiles\csy7wwro.default\searchplugins\delta.xml [2013-06-16]
FF SearchPlugin: C:\Users\Posos\AppData\Roaming\Mozilla\Firefox\Profiles\csy7wwro.default\searchplugins\do-search.xml [2015-06-15]
FF Extension: Search Enginer - C:\Users\Posos\AppData\Roaming\Mozilla\Firefox\Profiles\csy7wwro.default\Extensions\sweetsearch@gmail.com [2015-06-15]
R2 ExpatShieldService; C:\Program Files\Expat Shield\bin\openvpnas.exe [331608 2012-01-06] ()
R2 ExpatSrv; C:\Program Files\Expat Shield\HssWPR\hsssrv.exe [363336 2012-01-05] (AnchorFree Inc.)
S3 ExpatTrayService; C:\Program Files\Expat Shield\bin\ExpatTrayService.EXE [77520 2012-01-06] ()
R2 ExpatWd; C:\Program Files\Expat Shield\bin\hsswd.exe [329544 2012-01-05] ()
FF Extension: Expat Shield Helper (Please allow this installation) - C:\Program Files\Mozilla Firefox\extensions\afurladvisor@anchorfree.com [2015-06-03]
FF HKLM\...\Firefox\Extensions: [sweetsearch@gmail.com] - C:\Users\Posos\AppData\Roaming\Mozilla\Firefox\Profiles\csy7wwro.default\extensions\sweetsearch@gmail.com
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S1 SBRE; \SystemRoot\system32\drivers\SBREDrv.sys [X]
S1 Smb; system32\DRIVERS\smb.sys [X]
C:\Users\Posos\Downloads\SpyHunter-Installer.exe
C:\Program Files\MiuiTab
C:\ProgramData\bI727S.dat
C:\ProgramData\YHeqNfm3.exe
C:\ProgramData\YHeqNfm3.exe.b
C:\ProgramData\YHeqNfm3.exe_.b
C:\ProgramData\IHProtectUpDate
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.
Powstanie plik fixlog.txt.
Daj ten log.

5) Spróbuj teraz ściągnąć i użyć Adw-Cleaner http://www.programosy.pl/program,adwcleaner.html
najpierw kliknij na SZUKAJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ (CLEANING), to kliknij na niego.
Pokaż raport z niego C:\AdwCleaner\AdwCleaner[S].txt

6) Zrób nowe logi z FRST.
Przed skanem zaznacz "Additional" oraz "Shortcut"
.

**Posty:** 3 · przez **sywi** 19 Cze 2015, 19:30

Ok, tak wiec wrzucam wszystkie te pliki, program na razie zniknal.

**Posty:** 4765 · przez **ordynat** 19 Cze 2015, 20:12

Jest OK, możemy kończyć:

Do Notatnika wklej:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes] [-HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes] [-HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes]

Z Menu Notatnika >> Plik >> Zapisz jako >> Ustaw rozszerzenie na Wszystkie pliki >> Zapisz jako> FIX.REG >>
plik uruchom (dwuklik i OK).

W Adw-Cleaner kliknij na przycisk Odinstaluj (UNINSTALL).

Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix.
przez SHIFT+DEL usuń pozostały folder C:\FRST
.

**Posty:** 3 · przez **sywi** 19 Cze 2015, 20:26

Spoko, dziekuje za pomoc.