Proszę o pomoc jak usunąć to ustrojstwo?
FRST http://wklej.org/id/1685715/
ADDITION http://wklej.org/id/1685716/
Odinstaluj Search App by Ask.Otwórz notatnik systemowy i wklej:
HKLM\...\Run: [RTHDVCPL] = C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12921488 2012-07-02] (Realtek Semiconductor)
HKLM-x32\...\Run: [SpeedTouch USB Diagnostics] = C:\Users\inkaso\Desktop\moj_pokoj\Dragdiag.exe [888832 2004-03-23] (THOMSON Telecom Belgium)
HKU\S-1-5-21-3626592761-2476605276-1021804909-1001\...\Run: [pricefountainw.exe] = C:\Users\inkaso\AppData\Local\PriceFountain\pricefountainw.exe HKEY_CURRENT_USER Software\PriceFountain
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://do-search.com/?type=hpts=1426361277from=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQD
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://do-search.com/?type=hpts=1426361277from=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQD
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://do-search.com/web/?type=dsts=1426361277from=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQDq={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://do-search.com/web/?type=dsts=1426361277from=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQDq={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://do-search.com/?type=hpts=1426361277from=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQD
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://do-search.com/?type=hpts=1426361277from=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQD
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://do-search.com/web/?type=dsts=1426361277from=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQDq={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://do-search.com/web/?type=dsts=1426361277from=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQDq={searchTerms}
HKU\S-1-5-21-3626592761-2476605276-1021804909-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://do-search.com/?type=hpts=1426361277from=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQD
HKU\S-1-5-21-3626592761-2476605276-1021804909-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://do-search.com/?type=hpts=1426361277from=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQD
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://do-search.com/web/?type=dsts=1426361277from=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQDq={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://do-search.com/web/?type=dsts=1426361277from=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQDq={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://do-search.com/web/?type=dsts=1426361277from=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQDq={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://do-search.com/web/?type=dsts=1426361277from=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQDq={searchTerms}
SearchScopes: HKU\S-1-5-21-3626592761-2476605276-1021804909-1001 - DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://do-search.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQDts=1426361321type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-3626592761-2476605276-1021804909-1001 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://do-search.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQDts=1426361321type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-3626592761-2476605276-1021804909-1001 - {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://do-search.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQDts=1426361321type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-3626592761-2476605276-1021804909-1001 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://do-search.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQDts=1426361321type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-3626592761-2476605276-1021804909-1001 - {5D71DD89-31A3-4557-846B-0C1DC223A523} URL = http://do-search.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQDts=1426361321type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-3626592761-2476605276-1021804909-1001 - {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://do-search.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQDts=1426361321type=defaultq={searchTerms}
BHO-x32: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\XTab\SupTab.dll [2015-03-10] (Thinknice Co. Limited)
FF NewTab: hxxp://do-search.com/newtab/?type=ntts=1426361277from=coruid=ST500DM002-1BD142_Z3T5RYQDXXXXZ3T5RYQD
FF DefaultSearchEngine: do-search
FF SelectedSearchEngine: do-search
FF SearchPlugin: C:\Users\inkaso\AppData\Roaming\Mozilla\Firefox\Profiles\covmvayp.default\searchplugins\do-search.xml [2015-04-12]
FF Extension: Search Enginer - C:\Users\inkaso\AppData\Roaming\Mozilla\Firefox\Profiles\covmvayp.default\Extensions\searchengine@gmail.com [2015-03-14]
FF Extension: Strong Signal - C:\Users\inkaso\AppData\Roaming\Mozilla\Firefox\Profiles\covmvayp.default\Extensions\{02df6ed9-d89d-425c-afc3-3a79ad6ce5ef}.xpi [2015-03-08]
FF HKLM-x32\...\Firefox\Extensions: [searchengine@gmail.com] - C:\Users\inkaso\AppData\Roaming\Mozilla\Firefox\Profiles\covmvayp.default\extensions\searchengine@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [istart_ffnt@gmail.com] - C:\Users\inkaso\AppData\Roaming\Mozilla\Firefox\Profiles\covmvayp.default\extensions\istart_ffnt@gmail.com
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [493712 2015-03-14] (SysTool PasSame LIMITED)
S2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [X]
S3 esgiguard; \\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
2015-03-14 21:28 - 2015-03-14 21:28 - 00000000 ____ D () C:\Users\inkaso\AppData\Roaming\do-search
2015-03-14 21:28 - 2015-03-14 21:28 - 00000000 ____ D () C:\ProgramData\WindowsMangerProtect
2015-03-14 21:28 - 2015-03-14 21:28 - 00000000 ____ D () C:\Program Files (x86)\XTab
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.
Skasuj folder C:\FRST.