regedit.exe, ccleaner nie dziala

[allx]

Witam. Mam problem dziś chciałem pogrzebać w regedit  i nie udalo sie, gdy chcę otworzyć ccleaner'a nawet po przeinsalowaniu sie nie odpala, dodam ze próbowałem odpalic kombofix ale ten wykrywa mój system jako win 2000.

 

proszę o radę.

 

 

 

 

FRST.txt

Addition.txt

[jessica]

1) Odinstaluj ten program:

Update for PriceFountain (HKU\S-1-5-21-1603798188-3409358739-4023605629-1001\...\Price Fountain) (Version:  - Update for PriceFountain) <==== ATTENTION

 

2) Otwórz Notatnik i wklej w nim:

 

HKLM-x32\...\Run: [CMD] => cmd.exe /c start http://zivlingamer.org&& exit
HKU\S-1-5-21-1603798188-3409358739-4023605629-1001\...\Run: [EpicScale] => [X]
IFEO\adwcleaner_4.204.exe: [Debugger] svchost.exe
IFEO\AnVir.exe: [Debugger] svchost.exe
IFEO\AutoLogger.exe: [Debugger] svchost.exe
IFEO\avz.exe: [Debugger] svchost.exe
IFEO\CCleaner.exe: [Debugger] svchost.exe
IFEO\CCleaner64.exe: [Debugger] svchost.exe
IFEO\FRST.exe: [Debugger] svchost.exe
IFEO\FRST64.exe: [Debugger] svchost.exe
IFEO\HiJackThis.exe: [Debugger] svchost.exe
IFEO\regedit.exe: [Debugger] svchost.exe
IFEO\RegWorks.exe: [Debugger] svchost.exe
IFEO\RSIT.exe: [Debugger] svchost.exe
IFEO\RSITx64.exe: [Debugger] svchost.exe
ShortcutTarget: Registration Brothers In Arms.LNK -> D:\Users\Albert\Downloads\[ DARMOWE-TORENTY.PL ] Brothers In Arms Road To Hill 30 [PL]\BIA\Support\Register\RegistrationReminder.exe (No File)
ShortcutTarget: Registration Heroes of Might & Magic 5 - Hammers of Fate.LNK -> D:\Program Files (x86)\Ubisoft\Heroes of Might and Magic V Collector Edition\registrationa1\RegistrationReminder.exe (No File)
ShortcutTarget: Registration Heroes of Might & Magic 5 - Tribes of the East.LNK -> D:\Program Files (x86)\Ubisoft\Heroes of Might and Magic V - Dzikie Hordy\registration\RegistrationReminder.exe (No File)
ShortcutTarget: Registration Heroes of Might & Magic 5.LNK -> D:\Program Files (x86)\Ubisoft\Heroes of Might and Magic V Collector Edition\registration\RegistrationReminder.exe (No File)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hppp&ts=1420906686&from=cor&uid=WDCXWD1600AAJS-00PSA0_WD-WMAP9184929449294
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1420906610&from=cor&uid=WDCXWD1600AAJS-00PSA0_WD-WMAP9184929449294&q={searchTerms}
Task: {0881D68E-8B47-4413-8A55-A56B955A6A21} - System32\Tasks\YTAHelper => C:\Program Files (x86)\YTAHelper\YTAHelper.exe <==== ATTENTION
Task: {0D7CF67F-9FFC-4D8F-A780-6ECC2EA58DAA} - System32\Tasks\Installer_shopperpro => C:\Users\Albert\AppData\Local\Installer\Installshopperpro_25350\DCytaiesmt_smtyc_setup.exe <==== ATTENTION
Task: {83802072-3D81-4B14-909A-F58285014A37} - System32\Tasks\YTAUpdate_logon => C:\PROGRA~2\YOUTUB~1\Updater.exe <==== ATTENTION
Task: {91A579AE-5DBA-48CE-BF70-CBA20335DF6F} - System32\Tasks\SMW_UpdateTask_Time_343139353431323131382d5a4a6c414a34572a506c415a => Wscript.exe //B "C:\ProgramData\SearchModule\smhe.js" smu.exe /invoke /f:check_services /l:0 <==== ATTENTION
Task: {A986801E-259D-45FF-80DA-9FE130563DA9} - System32\Tasks\{6829FEB9-37F4-4DBB-B852-0E9B1EF731B3} => pcalua.exe -a "C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe" -c /AppMode=SETUP /Uninstall /UDS=1
Task: {CE847ECB-1E4F-4C36-86C7-0E3DDE85B25A} - System32\Tasks\SMWUpd => C:\Program Files\Common Files\Goobzo\GBUpdate\updater.exe <==== ATTENTION
Task: {E526EF94-64BF-42E4-B16F-C366E681CAE7} - System32\Tasks\YTAUpdate => C:\PROGRA~2\YOUTUB~1\Updater.exe <==== ATTENTION
C:\Program Files\Common Files\Goobzo
C:\ProgramData\SearchModule
C:\PROGRA~2\YOUTUB~1
C:\Users\Albert\AppData\Local\Installer\Installshopperpro_25350
Reg: reg delete HKU\S-1-5-21-1603798188-3409358739-4023605629-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v GoobzoYouTubeAccelerator /f
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hppp&ts=1420906686&from=cor&uid=WDCXWD1600AAJS-00PSA0_WD-WMAP9184929449294
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1420906610&from=cor&uid=WDCXWD1600AAJS-00PSA0_WD-WMAP9184929449294&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1603798188-3409358739-4023605629-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=dspp&ts=1420906686&from=cor&uid=WDCXWD1600AAJS-00PSA0_WD-WMAP9184929449294&q={searchTerms}
BHO: No Name -> {95B7759C-8C7F-4BF1-B163-73684A933233} ->  No File
BHO: YTAHelper -> {FCE3FA8B-BA81-467C-81D8-E43C00D1BC71} ->  No File
BHO-x32: No Name -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} ->  No File
BHO-x32: No Name -> {95B7759C-8C7F-4BF1-B163-73684A933233} ->  No File
BHO-x32: No Name -> {b608cc98-54de-4775-96c9-097de398500c} ->  No File
FF SelectedSearchEngine: AVG Secure Search
FF Keyword.URL: hxxp://www-searches.com/search.aspx?s=F1Ezdefytd1,6b6268af-3076-4d9c-a5b6-1edc0b59a364,&q=
FF SearchPlugin: C:\Users\Albert\AppData\Roaming\Mozilla\Firefox\Profiles\t1dq93ol.default\searchplugins\omiga-plus.xml [2015-01-10]
FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\Albert\AppData\Roaming\Mozilla\Firefox\Profiles\t1dq93ol.default\extensions\fftoolbar2014@etech.com
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> E:\VLC\npvlc.dll No File
FF SearchPlugin: C:\Users\Albert\AppData\Roaming\Mozilla\Firefox\Profiles\t1dq93ol.default\searchplugins\omiga-plus.xml [2015-01-10]
FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\Albert\AppData\Roaming\Mozilla\Firefox\Profiles\t1dq93ol.default\extensions\fftoolbar2014@etech.com
S2 YouTubeAcceleratorService; C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe -start -scm [X]
S3 SMUpdd; \??\C:\Program Files\Common Files\Goobzo\GBUpdate\smw.sys [X]
S3 xhunter1; \??\C:\WINDOWS\xhunter1.sys [X]
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.
Powstanie plik fixlog.txt.
Daj ten log.

 

3) Zrób nowe logi FRST

 

jessi

[allx]

1) Odinstaluj ten program:

Update for PriceFountain (HKU\S-1-5-21-1603798188-3409358739-4023605629-1001\...\Price Fountain) (Version:  - Update for PriceFountain) <==== ATTENTION

 

2) Otwórz Notatnik i wklej w nim:

 

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe

Uruchom FRST i kliknij przycisk Fix.

Powstanie plik fixlog.txt.

Daj ten log.

 

3) Zrób nowe logi FRST

 

jessi

Fixlog.txt

FRST.txt

Addition.txt

[jessica]

Nie wszystko się usunęło - brak logu Shortcut.TXT, więc improwizowałam, ale to nie udało się. To mało ważne, więc zostawiamy to w spokoju.

 

Wg mnie powinno już być OK.

 

Otwórz Notatnik i wklej w nim:

 

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix.
przez SHIFT+DEL usuń pozostały folder C:\FRST.

 

jessi

[allx]

dzieki wielkie wszystko dziala