AntyWhereAccess Setup Wizard, czyli wyskakujące okienko, podcas przeglądania internetu

Dla specjalistów Bezpieczeństwo
#1

Cześć.

#2

Farbar Recovery Scan Tool - Raport obowiązkowy

#3

http://wklej.org/id/1706185/

http://wklej.org/id/1706186/

#4

Pobierz i uruchom AdwCleaner Kliknij Scan i później Cleaning.

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

CloseProcesses:
IFEO\ccleaner64.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
IFEO\msoxmled.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
IFEO\powerpnt.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
IFEO\Winword.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1430998805&z=fe7b28d4868aab0a64e7d0cg2z6cbe6tft9bfbae3z&from=obw&uid=WDCXWD5000AAKS-22A7B0_WD-WMASY342976529765&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1430998805&z=fe7b28d4868aab0a64e7d0cg2z6cbe6tft9bfbae3z&from=obw&uid=WDCXWD5000AAKS-22A7B0_WD-WMASY342976529765&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1430998805&z=fe7b28d4868aab0a64e7d0cg2z6cbe6tft9bfbae3z&from=obw&uid=WDCXWD5000AAKS-22A7B0_WD-WMASY342976529765&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1430998805&z=fe7b28d4868aab0a64e7d0cg2z6cbe6tft9bfbae3z&from=obw&uid=WDCXWD5000AAKS-22A7B0_WD-WMASY342976529765&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.istartsurf.com/?type=sc&ts=1430998805&z=fe7b28d4868aab0a64e7d0cg2z6cbe6tft9bfbae3z&from=obw&uid=WDCXWD5000AAKS-22A7B0_WD-WMASY342976529765
R2 rypudide; C:\Users\Paweł\AppData\Roaming\1E00B520-1430998691-9101-D98E-00235437818C\jnscCCC1.tmp [181248 2015-05-07] () [File not signed]
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [337064 2015-05-07] (SysTool PasSame LIMITED) <==== ATTENTION
C:\Windows\system32\Drivers\etc\hosts.txt
C:\ProgramData\2ddf06a200004260
C:\Users\Paweł\AppData\Local\Crossbrowse
C:\Users\Paweł\AppData\Local\1E00B520-1431006081-9101-D98E-00235437818C
C:\ProgramData\WindowsMangerProtect
C:\Users\Paweł\AppData\Roaming\1E00B520-1430998691-9101-D98E-00235437818C
C:\Users\Paweł\AppData\Local\globalUpdate
Hosts:
EmptyTemp:

Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.

Kliknij Scan i pokaż nowy raport z FRST bez Addition i Shortcut.