Witam, ostatnio na stronie startowej pojawiła mi się strona, jak w temacie. Proszę o pomoc w usunięciu.
Odinstaluj XTab.Otwórz notatnik systemowy i wklej:
AlternateDataStreams: C:\ProgramData:NT
AlternateDataStreams: C:\ProgramData:NT2
AlternateDataStreams: C:\Users\All Users:NT
AlternateDataStreams: C:\Users\All Users:NT2
AlternateDataStreams: C:\Users\ABC\Application Data:NT
AlternateDataStreams: C:\Users\ABC\Application Data:NT2
AlternateDataStreams: C:\Users\ABC\AppData\Roaming:NT
AlternateDataStreams: C:\Users\ABC\AppData\Roaming:NT2
AlternateDataStreams: C:\ProgramData\Application Data:NT
AlternateDataStreams: C:\ProgramData\Application Data:NT2
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2
HKLM-x32\...\Run: [] = [X]
HKLM-x32\...\Run: [Adobe ARM] = C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKU\S-1-5-21-3167146019-4127528466-3727902049-1001\...\RunOnce: [Adobe Speed Launcher] = 1424355061
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hpts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hpts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=dsts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=dsts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hpts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hpts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=dsts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=dsts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5q={searchTerms}
HKU\S-1-5-21-3167146019-4127528466-3727902049-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hpts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5
HKU\S-1-5-21-3167146019-4127528466-3727902049-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hpts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=dsts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=dsts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=dsts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=dsts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5q={searchTerms}
SearchScopes: HKU\S-1-5-21-3167146019-4127528466-3727902049-1001 - DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://istart.webssearches.com/web/?utm_source=butm_medium=kmputm_campaign=install_ieutm_content=dsfrom=kmpuid=395049983_1052515_7CD4A4C5ts=1424178058type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-3167146019-4127528466-3727902049-1001 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://istart.webssearches.com/web/?utm_source=butm_medium=kmputm_campaign=install_ieutm_content=dsfrom=kmpuid=395049983_1052515_7CD4A4C5ts=1424178058type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-3167146019-4127528466-3727902049-1001 - {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://istart.webssearches.com/web/?utm_source=butm_medium=kmputm_campaign=install_ieutm_content=dsfrom=kmpuid=395049983_1052515_7CD4A4C5ts=1424178058type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-3167146019-4127528466-3727902049-1001 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?utm_source=butm_medium=kmputm_campaign=install_ieutm_content=dsfrom=kmpuid=395049983_1052515_7CD4A4C5ts=1424178058type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-3167146019-4127528466-3727902049-1001 - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://istart.webssearches.com/web/?utm_source=butm_medium=kmputm_campaign=install_ieutm_content=dsfrom=kmpuid=395049983_1052515_7CD4A4C5ts=1424178058type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-3167146019-4127528466-3727902049-1001 - {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://istart.webssearches.com/web/?utm_source=butm_medium=kmputm_campaign=install_ieutm_content=dsfrom=kmpuid=395049983_1052515_7CD4A4C5ts=1424178058type=defaultq={searchTerms}
BHO-x32: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\XTab\SupTab.dll (Thinknice Co. Limited)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe http://istart.webssearches.com/?type=scts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5
FF DefaultSearchEngine: webssearches
FF SelectedSearchEngine: webssearches
FF Homepage: hxxp://istart.webssearches.com/?type=hpts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5
FF SearchPlugin: C:\Users\ABC\AppData\Roaming\Mozilla\Firefox\Profiles\06lwmq0s.default\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wtu-secure-search.xml
FF Extension: Fast Start - C:\Users\ABC\AppData\Roaming\Mozilla\Firefox\Profiles\06lwmq0s.default\Extensions\faststartff@gmail.com [2015-02-17]
FF Extension: Search Enginer - C:\Users\ABC\AppData\Roaming\Mozilla\Firefox\Profiles\06lwmq0s.default\Extensions\searchengine@gmail.com [2015-02-17]
FF HKLM-x32\...\Firefox\Extensions: [searchengine@gmail.com] - C:\Users\ABC\AppData\Roaming\Mozilla\Firefox\Profiles\06lwmq0s.default\extensions\searchengine@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\ABC\AppData\Roaming\Mozilla\Firefox\Profiles\06lwmq0s.default\extensions\faststartff@gmail.com
CHR StartupUrls: Default - "hxxp://www.google.pl/", "hxxp://istart.webssearches.com/?type=hpts=1424177992from=kmpuid=395049983_1052515_7CD4A4C5"
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158896 2015-01-16] (XTab system)
R2 vToolbarUpdater18.1.10; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.10\ToolbarUpdater.exe [1849368 2014-11-06] (AVG Secure Search)
U3 aq5r2ufo; C:\Windows\System32\Drivers\aq5r2ufo.sys [0] (Advanced Micro Devices) ==== ATTENTION (zero size file/folder)
U3 arzfn74t; C:\Windows\System32\Drivers\arzfn74t.sys [0] (Advanced Micro Devices) ==== ATTENTION (zero size file/folder)
S1 EIO64; system32\DRIVERS\EIO64.sys [X]
S3 FairplayKD; \\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [X]
S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [X]
2015-02-17 14:01 - 2015-02-17 14:01 - 00000000 ____ D () C:\ProgramData\IHProtectUpDate
2015-02-17 14:00 - 2015-02-17 14:01 - 00000000 ____ D () C:\Program Files (x86)\XTab
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.
Pomogło, lecz tylko połowicznie. Obecnie po uruchomieniu Chrome pojawiają się dwie strony: pierwsza to wyszukiwarka Google, a druga nieszczęsny webssearches.