Jak usunąć Mystartsearch

Dla specjalistów Bezpieczeństwo
#1

Witam,

#2

Nowy log obowiązkowy - Farbar Recovery Scan Tool

#3

Podaję pliki z Farbar Recovery Scan Tool:

#4

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3605743884-3492222633-3518557076-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3605743884-3492222633-3518557076-1000\...\Policies\system: [DisableChangePassword] 0
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=ds&ts=1415991636&from=smt&uid=ST9320325AS_6VD5MFM6&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hp&ts=1415991636&from=smt&uid=ST9320325AS_6VD5MFM6
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hp&ts=1415991636&from=smt&uid=ST9320325AS_6VD5MFM6
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=ds&ts=1415991636&from=smt&uid=ST9320325AS_6VD5MFM6&q={searchTerms}
URLSearchHook: HKCU - (No Name) - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=sc&ts=1415991564&from=smt&uid=ST9320325AS_6VD5MFM6
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1415991636&from=smt&uid=ST9320325AS_6VD5MFM6&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1415991636&from=smt&uid=ST9320325AS_6VD5MFM6&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1415991636&from=smt&uid=ST9320325AS_6VD5MFM6&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1415991636&from=smt&uid=ST9320325AS_6VD5MFM6&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1415991636&from=smt&uid=ST9320325AS_6VD5MFM6&q={searchTerms}
SearchScopes: HKCU - {960D9F27-9B32-4258-B18C-1071CB34A577} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^PL&apn_uid=89CE06F8-E63F-4CA5-AC1F-EC17C42F9B0D&apn_sauid=5FDF610D-1598-42B2-AC5E-4A60827ACAE3
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKU\S-1-5-21-3605743884-3492222633-3518557076-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Compaq\AppData\Roaming\Mozilla\Firefox\Profiles\u0he0vvy.default\extensions\faststartff@gmail.com
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://www.mystartsearch.com/?type=sc&ts=1415991636&from=smt&uid=ST9320325AS_6VD5MFM6
C:\AdwCleaner
C:\Users\Compaq\Downloads\Adwcleaner_4.101_www.INSTALKI.pl.exe
C:\AdwCleaner*.txt
Task: {1DC7C098-BD29-43EF-84E1-D1B2FFCEDAF5} - System32\Tasks\{AE6BE916-7F8E-46D8-8773-84A512263A7C} => E:\start.exe
Task: {5E402F42-5461-40B7-9659-EB5A25D4B20D} - System32\Tasks\{9215AFE3-EC1B-405D-84EF-C707331F96CC} => Firefox.exe http://ui.skype.com/ui/0/4.2.0.166.321/pl/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;notincluded
Task: {6E635237-8250-409D-A56B-4EB25160E271} - System32\Tasks\{53244743-C12E-46AF-AE31-9F86CDD38DCD} => E:\start.exe
Task: {7BE968A5-C0C7-4F01-8070-CE852D29CBDE} - System32\Tasks\{FFD9411D-FAF5-4C17-8BC0-7540C25FC1CF} => E:\start.exe
Task: {921937D3-BFD2-47C9-AA96-7F2631B05142} - System32\Tasks\{34F43BAA-9095-4E76-8F17-01382317D301} => E:\start.exe
Task: {C8FEAB55-BD74-4F5D-B474-337EB372C7DC} - System32\Tasks\{BF491D84-8E81-4D63-8DCB-506584DEF050} => E:\start.exe
Task: {E51BB5DD-7ABD-4BE7-83D0-1AA1EF852B47} - System32\Tasks\{18B88E41-2EF6-45E7-9486-EEDE30A373C6} => E:\start.exe
Task: {F60EB9EF-AAF1-4001-A801-18372B5777A4} - System32\Tasks\{50AE1E0B-93C5-4D86-BD1B-FA06992CC075} => Firefox.exe http://ui.skype.com/ui/0/4.2.0.166.321/pl/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;notincluded
EmptyTemp:

Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.

Kliknij Scan i pokaż nowy raport z FRST bez Addition.

#5

FRST po ponownym skanie: http://wklej.org/id/1522185/

#6

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
C:\Users\Compaq\Downloads\Raw-Therapee(13042)-dp.exe
DeleteQuarantine:

Uruchom FRST i kliknij Fix. Skasuj folder C:\FRST

Usuń stare punkty przywracania: Aby usunąć wszystkie punkty przywracania

Przeczytaj w jaki sposób należy instalować programy: KLIK - KLIK - KLIK - KLIK

Odinstaluj:

Adobe Reader XI

Adobe Shockwave Player 11.5

Adobe Shockwave Player 12.0

Java 7 Update 55

Zainstaluj:

Adobe Reader XI 11.0.9

Java 8 Update 25

#7

Link, który się pod tym kryje przekierowuje do następującej strony, pojawia się komunikat:

#8

Link jest prawidłowy, a błąd zgłosiłem:

http://forum.dobreprogramy.pl/zgłoszenia-błędów-w-nowej-wersji-forum-t460248/page-15#entry3116176

Skopiuj i wklej w pasek adresu przeglądarki:

http://windows.microsoft.com/pl-pl/windows/delete-restore-point#1TC=windows-7
#9

Dziękuję bardzo, komputer śmiga szybko i AdwCleaner nie wykrywa już żadnych śmieci.