Dynamo Combo po pobieraniu z dobreprogramy

[Bartok]

Witam

Bardzo proszę o sprawdzenie logów. Główną przyczyną problemu jest dynamo combo, którego zainstalowałem nieświadomie razem z WinMTR pobranym z "dobreprogramy" w celu sprawdzenia usługi internetowej. Jako laik próbowałem już konwencjonalnych metod usunięcia problemu - bez rezultatów.

Addition.txt

FRST.txt

Shortcut.txt

[picasso]

Na temat pobierania z dobrychprogramów i podobnych: KLIK. W systemie są liczne ślady po operacjach "Asystenta pobierania". Dodatkowo, będę wyrzucać szczątki Firefox, który wygląda na odinstalowany.

 

 

1. Na początek odinstaluj stare wersje i zbędniki: Acrobat.com, Adobe AIR, Adobe Flash Player 10 ActiveX, Adobe Reader 9.1 MUI, Adobe Shockwave Player 12.0, ASUS WebStorage, Gadu-Gadu 10, Java™ 6 Update 22, McAfee Security Scan Plus.

 

2. Otwórz Notatnik i wklej w nim:

 

CloseProcesses:
CreateRestorePoint:
R1 {ebd8d0c0-e022-4b76-a1f2-bc2963e3a147}Gw64; C:\Windows\System32\drivers\{ebd8d0c0-e022-4b76-a1f2-bc2963e3a147}Gw64.sys [48792 2015-01-15] (StdLib)
R2 Update Dynamo Combo; C:\Program Files (x86)\Dynamo Combo\updateDynamoCombo.exe [529656 2015-01-16] ()
R2 Util Dynamo Combo; C:\Program Files (x86)\Dynamo Combo\bin\utilDynamoCombo.exe [529656 2015-01-16] ()
U3 tmlwf; No ImagePath
U3 tmwfp; No ImagePath
HKLM-x32\...\Run: [] => [X]
AppInit_DLLs: C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\datamngr.dll => C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\datamngr.dll File Not Found
AppInit_DLLs: C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\IEBHO.dll => C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\IEBHO.dll File Not Found
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hp&ts=1421355669&from=cor&uid=3219913727_67194_C0AC3FE1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1421355669&from=cor&uid=3219913727_67194_C0AC3FE1&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hp&ts=1421355669&from=cor&uid=3219913727_67194_C0AC3FE1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1421355669&from=cor&uid=3219913727_67194_C0AC3FE1&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1421355669&from=cor&uid=3219913727_67194_C0AC3FE1&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1421355669&from=cor&uid=3219913727_67194_C0AC3FE1&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1421355669&from=cor&uid=3219913727_67194_C0AC3FE1&q={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3827299707-3164848222-3303958406-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3827299707-3164848222-3303958406-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1421355669&from=cor&uid=3219913727_67194_C0AC3FE1&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3827299707-3164848222-3303958406-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
SearchScopes: HKU\S-1-5-21-3827299707-3164848222-3303958406-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms}
BHO-x32: Dynamo Combo 1.0.0.6 -> {986c37a1-7b65-476f-80dc-54f80bd4b0d6} -> C:\Program Files (x86)\Dynamo Combo\DynamoCombobho.dll (Dynamo Combo)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM-x32 - No Name - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - No File
Toolbar: HKU\S-1-5-21-3827299707-3164848222-3303958406-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Task: {0C591A53-BF78-4717-90A5-17F20B033475} - System32\Tasks\{06BAC61C-2CEA-45C6-8A69-D29B173DE88D} => pcalua.exe -a E:\Autorun.exe -d E:\
Task: {3D2AEA76-67EB-4661-A72D-4BBEECFEF2A1} - System32\Tasks\{49E5177D-AB23-497D-8EE7-F0B9EB15EA0F} => pcalua.exe -a E:\Setup.exe -d E:\
Task: {D0208C5A-0D27-4A6A-9FA2-D11771EE1063} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe
C:\Program Files (x86)\Dynamo Combo
C:\Program Files (x86)\Mozilla Firefox
C:\Program Files (x86)\Mozilla Maintenance Service
C:\ProgramData\Mozilla
C:\ProgramData\Temp
C:\Users\Bartek Szymuś\AppData\Local\Mozilla
C:\Users\Bartek Szymuś\AppData\Roaming\Mozilla
C:\Users\Gość\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
C:\Users\Gość\Desktop\*.lnk
C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
C:\Windows\System32\drivers\{ebd8d0c0-e022-4b76-a1f2-bc2963e3a147}Gw64.sys
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f
Reg: reg delete HKCU\Software\Mozilla /f
Reg: reg delete HKCU\Software\MozillaPlugins /f
Reg: reg delete HKLM\SOFTWARE\Mozilla /f
Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\mozilla.org /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Reader Speed Launcher" /f
EmptyTemp:

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Czekaj cierpliwie, nie przerywaj działania. Gdy Fix ukończy pracę, system zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

 

3. Zrób nowy log FRST z opcji Scan (bez Addition i Shortcut). Dołącz też plik fixlog.txt.