Jak Pozbyć sie qooglle

[lorwal101]

Ratunku od pewnego czasu wyskakuje mi pewna strona ktora pokazuje dziwne rzeczy... Nie moge sie jej pozbyc po kazdym restarcie wyskakuje to samo. Ta strona Nazywa sie qooglle RAtunku

OTL.TxtPobieranie informacji ...

Extras.TxtPobieranie informacji ...

[Landuss]

1. Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej następujący tekst:

 

:Files
C:\WINDOWS\tasks\At*.job
 
:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = "http://start.facemoods.com/?a=bfus&s={searchTerms}&f=4"
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = "http://www.qooqlle.com/"
FF - prefs.js..browser.search.selectedEngine: "qooqlle"
FF - prefs.js..browser.startup.homepage: "http://www.qooqlle.com/"
[2011-08-13 17:33:06 | 000,002,566 | ---- | M] () -- C:\Documents and Settings\SiemaEniu\Dane aplikacji\Mozilla\Firefox\Profiles\zxgw8js9.default\searchplugins\askcom.xml
[2011-09-18 10:24:59 | 000,001,860 | ---- | M] () -- C:\Documents and Settings\SiemaEniu\Dane aplikacji\Mozilla\Firefox\Profiles\zxgw8js9.default\searchplugins\search.xml
[2011-07-02 16:50:59 | 000,002,423 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2011-08-10 11:13:43 | 000,002,047 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
CHR - default_search_provider: search_url = "http://www.google.com/cse?cx=partner-pub-5462406484424654%3A8q0sn8-w2ss&ie=ISO-8859-1&q={searchTerms}&sa=Search&siteurl=qooqlle.com%2F"
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Alcmtr] ALCMTR.EXE File not found
O4 - HKLM..\Run: [nwiz] nwiz.exe /install File not found
O4 - HKLM..\Run: [Readar_sl] C:\Documents and Settings\SiemaEniu\Dane aplikacji\Readar_sl.exe (Created with WinAutomation ("http://www.WinAutomation.com"))
O4 - HKLM..\Run: [RTHDCPL] RTHDCPL.EXE File not found
O4 - HKLM..\Run: [svchost.exe] C:\Documents and Settings\SiemaEniu\Dane aplikacji\file\adobe.exe ()
O4 - HKLM..\Run: [TunesHelper] C:\Documents and Settings\All Users\TunesHelper.exe ()
O4 - HKCU..\Run: [svchost.exe] C:\Documents and Settings\SiemaEniu\Dane aplikacji\file\adobe.exe ()
O4 - HKCU..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"  /MINIMIZED File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: svchost.exe = C:\Documents and Settings\SiemaEniu\Dane aplikacji\file\adobe.exe ()
 
:Commands
[emptyflash]
[emptytemp]

Kliknij w Wykonaj skrypt. Zatwierdź restart komputera.

 

2. Z panelu usuwania programów odinstaluj sponsoring DAEMON Tools Toolbar

 

3. Następnie uruchamiasz OTL ponownie, tym razem wywołujesz opcję Skanuj. Pokazujesz nowe logi z OTL oraz AD-Remover z opcji Scan.

 

 

.

[lorwal101]

TO JEST LOG.

 

 

All processes killed

========== FILES ==========

C:\WINDOWS\tasks\At1.job moved successfully.

C:\WINDOWS\tasks\At2.job moved successfully.

C:\WINDOWS\tasks\At3.job moved successfully.

C:\WINDOWS\tasks\At4.job moved successfully.

========== OTL ==========

HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

Prefs.js: "qooqlle" removed from browser.search.selectedEngine

Prefs.js: "http://www.qooqlle.com/" removed from browser.startup.homepage

C:\Documents and Settings\SiemaEniu\Dane aplikacji\Mozilla\Firefox\Profiles\zxgw8js9.default\searchplugins\askcom.xml moved successfully.

C:\Documents and Settings\SiemaEniu\Dane aplikacji\Mozilla\Firefox\Profiles\zxgw8js9.default\searchplugins\search.xml moved successfully.

C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml moved successfully.

C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrch.xml moved successfully.

Unable to fix default_search_provider items.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Alcmtr deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\nwiz deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Readar_sl deleted successfully.

C:\Documents and Settings\SiemaEniu\Dane aplikacji\Readar_sl.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\RTHDCPL deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\svchost.exe deleted successfully.

C:\Documents and Settings\SiemaEniu\Dane aplikacji\file\adobe.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\TunesHelper deleted successfully.

C:\Documents and Settings\All Users\TunesHelper.exe moved successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\svchost.exe deleted successfully.

File C:\Documents and Settings\SiemaEniu\Dane aplikacji\file\adobe.exe not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\uTorrent deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\\svchost.exe deleted successfully.

File C:\Documents and Settings\SiemaEniu\Dane aplikacji\file\adobe.exe not found.

========== COMMANDS ==========

 

[EMPTYFLASH]

 

User: All Users

 

User: Default User

->Flash cache emptied: 0 bytes

 

User: LocalService

 

User: NetworkService

 

User: SiemaEniu

->Flash cache emptied: 1832 bytes

 

Total Flash Files Cleaned = 0,00 mb

 

 

[EMPTYTEMP]

 

User: All Users

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: SiemaEniu

->Temp folder emptied: 1059402 bytes

->Temporary Internet Files folder emptied: 1139644 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 40872195 bytes

->Google Chrome cache emptied: 123284047 bytes

->Flash cache emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 19814 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 159,00 mb

 

 

OTL by OldTimer - Version 3.2.29.0 log created on 09182011_141204

 

Files\Folders moved on Reboot...

File\Folder C:\WINDOWS\temp\Perflib_Perfdata_84.dat not found!

 

Registry entries deleted on Reboot...

 

 

Juz ta stron wiecej nie wyskakuje dziekuje za pomoc

OTL.TxtPobieranie informacji ...

[Landuss]

Ale nie wykonałeś tego:

 

  Landuss napisał(a):

oraz AD-Remover z opcji Scan.

 

Czekam na log i przejdziemy do dalszych czynności końcowych.

Edytowane 30 Października 2011 przez picasso
30.10.2011 - Temat zostaje zamknięty z powodu braku odpowiedzi. //picasso