Witam. Mam problem z usunięciem KEY -FINDE z przeglądarki Firefox. Cały czas wyskakując i przez niego jakieś reklamy i przekierowuje do innych stron.
FRST:
http://www.wklej.org/id/1647895/
Addition:
Odinstaluj key-find uninstall.Otwórz notatnik systemowy i wklej:
HKLM\...\Run: [RtHDVCpl] = C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2015-02-26] (Realtek Semiconductor)
HKLM-x32\...\Run: [GrooveMonitor] = C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] = C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.key-find.com/?type=hpppts=1424937460from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.key-find.com/?type=hpppts=1424937460from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com/web/?type=dsts=1424937419from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com/web/?type=dsts=1424937419from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.key-find.com/?type=hpppts=1424937460from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.key-find.com/?type=hpppts=1424937460from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com/web/?type=dsts=1424937419from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com/web/?type=dsts=1424937419from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9q={searchTerms}
HKU\S-1-5-21-2699663138-3892626165-2854413263-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com/web/?type=dsppts=1424937460from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9q={searchTerms}
HKU\S-1-5-21-2699663138-3892626165-2854413263-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.key-find.com/?type=hpppts=1424937460from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9
HKU\S-1-5-21-2699663138-3892626165-2854413263-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.key-find.com/?type=hpppts=1424937460from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9
HKU\S-1-5-21-2699663138-3892626165-2854413263-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com/web/?type=dsppts=1424937460from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9q={searchTerms}
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.key-find.com/web/?type=dsts=1424937419from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.key-find.com/web/?type=dsts=1424937419from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.key-find.com/web/?type=dsts=1424937419from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.key-find.com/web/?type=dsts=1424937419from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9q={searchTerms}
SearchScopes: HKU\S-1-5-21-2699663138-3892626165-2854413263-1000 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.key-find.com/web/?type=dsppts=1424937460from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9q={searchTerms}
SearchScopes: HKU\S-1-5-21-2699663138-3892626165-2854413263-1000 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.key-find.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9ts=1424937503type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-2699663138-3892626165-2854413263-1000 - {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.key-find.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9ts=1424937503type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-2699663138-3892626165-2854413263-1000 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.key-find.com/web/?type=dsppts=1424937460from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9q={searchTerms}
SearchScopes: HKU\S-1-5-21-2699663138-3892626165-2854413263-1000 - {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.key-find.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9ts=1424937503type=defaultq={searchTerms}
BHO-x32: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\XTab\SupTab.dll (Thinknice Co. Limited)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.key-find.com/?type=scts=1424937419from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9
FF SelectedSearchEngine: key-find
FF HKLM-x32\...\Firefox\Extensions: [searchengine@gmail.com] - C:\Users\Cinek\AppData\Roaming\Mozilla\Firefox\Profiles\1eoivhef.default\extensions\searchengine@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Cinek\AppData\Roaming\Mozilla\Firefox\Profiles\1eoivhef.default\extensions\faststartff@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\Cinek\AppData\Roaming\Mozilla\Firefox\Profiles\1eoivhef.default\extensions\fftoolbar2014@etech.com
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://www.key-find.com/?type=scts=1424937419from=coruid=ST3500418AS_9VM5P0F9XXXX9VM5P0F9
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158896 2015-01-16] (XTab system)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [487056 2015-02-26] (SysTool PasSame LIMITED)
R1 {291bfea4-019b-41de-a68d-736bec29b080}Gw64; C:\Windows\System32\drivers\{291bfea4-019b-41de-a68d-736bec29b080}Gw64.sys [48784 2015-02-25] (StdLib)
S3 gdrv; \\C:\Windows\gdrv.sys [X]
2015-02-26 08:58 - 2015-02-26 08:58 - 00000000 ____ D () C:\ProgramData\IHProtectUpDate
2015-02-26 08:58 - 2015-02-26 08:58 - 00000000 ____ D () C:\Program Files (x86)\XTab
2015-02-26 08:57 - 2015-02-26 08:57 - 00000000 ____ D () C:\ProgramData\WindowsMangerProtect
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.