Browse pulse - help!

Dla specjalistów Bezpieczeństwo
#1

Cześć.

Proszę o pomoc w usunięciu dziadostwa pod nazwą BROWSE PULSE. W załączeniu logi z FRST.

Z góry dziękujęAddition.txtFRST.txt

#2

Odinstaluj Smart File Advisor 1.1.8.Otwórz notatnik systemowy i wklej:

CloseProcesses:
HKLM-x32\...\Run: [SFAUpdater] => C:\Program Files (x86)\Smart File Advisor\SFAUpdater.exe [656144 2015-03-18] (Filefacts.net)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://do-search.com/web/?type=ds&ts=1430162771&from=cor&uid=ST500LT012-1DG142_W3PCQ1Q0XXXXW3PCQ1Q0&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://do-search.com/web/?type=ds&ts=1430162771&from=cor&uid=ST500LT012-1DG142_W3PCQ1Q0XXXXW3PCQ1Q0&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://do-search.com/web/?type=ds&ts=1430162771&from=cor&uid=ST500LT012-1DG142_W3PCQ1Q0XXXXW3PCQ1Q0&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://do-search.com/web/?type=ds&ts=1430162771&from=cor&uid=ST500LT012-1DG142_W3PCQ1Q0XXXXW3PCQ1Q0&q={searchTerms}
HKU\S-1-5-21-1295626045-2784072392-131444661-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO-x32: browse pulse -> {ed8e593d-1965-4e45-9d55-d56162dcde14} -> C:\Program Files (x86)\browse pulse\Extensions\ed8e593d-1965-4e45-9d55-d56162dcde14.dll No File
CHR Extension: (browse pulse) - C:\Users\Piotr\AppData\Local\Google\Chrome\User Data\Default\Extensions\oohaifmlpecbkpanlpandmagoinoogjn [2015-04-28]
CHR HKU\S-1-5-21-1295626045-2784072392-131444661-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - https://clients2.google.com/service/update2/crx
OPR Extension: (browse pulse) - C:\Users\Piotr\AppData\Roaming\Opera Software\Opera Stable\Extensions\oohaifmlpecbkpanlpandmagoinoogjn [2015-05-03]
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.

#3

Zadziałało! Dzięki ci dobry człowieku

#4

Skasuj folder C:\FRST.