PriceFountain i inne jak usunąć

Dla specjalistów Bezpieczeństwo
#1

mógłby ktoś poradzić co robić

#2

Odinstaluj do-search uninstall,PriceFountain (remove only).Pobierz i uruchom jako administrator AdwCleaner https://toolslib.net/downloads/finish/1/ Kliknij Scan i później Cleaning.

Pokaż nowe logi z FRST.

#3

http://wklej.org/id/1693758/ frst

#4

Otwórz notatnik systemowy i wklej:

HKLM\...\Run: [RTHDVCPL] = C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6839952 2014-02-19] (Realtek Semiconductor)
HKLM-x32\...\Run: [CLVirtualDrive] = C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491320 2012-07-26] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] = C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKU\S-1-5-21-2240851517-4165771242-3290239378-1001\...\Run: [Facebook Update] = C:\Users\konrad\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-03-19] (Facebook Inc.)
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM - {FB1C95F2-5574-456A-B7BC-11490365766F} URL = http://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8tag=hp-uk3-vsb-21link%5Fcode=qsindex=apsfield-keywords={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://uk.search.yahoo.com/search?p={searchTerms}ei={inputEncoding}fr=chr-hp-psgtype=CPNTDF
SearchScopes: HKLM-x32 - {FB1C95F2-5574-456A-B7BC-11490365766F} URL = http://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8tag=hp-uk3-vsb-21link%5Fcode=qsindex=apsfield-keywords={searchTerms}
SearchScopes: HKU\.DEFAULT - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2240851517-4165771242-3290239378-1001 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
CHR StartupUrls: Default - "hxxp://do-search.com/?type=hpts=1429456870from=coruid=HitachiXHTS547550A9E384_J2100050KMRBJAKMRBJAX"
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.90\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.90\pdf.dll No File
CHR Plugin: (Norton Confidential) - C:\Users\konrad\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\npcoplgn.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Extension: (Bookmark Manager) - C:\Users\konrad\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-17]
U4 WMCoreService; No ImagePath
2015-04-21 19:29 - 2015-04-21 19:33 - 00000000 ____ D () C:\AdwCleaner
2015-04-21 19:26 - 2015-04-21 19:26 - 00003150 _____ () C:\WINDOWS\System32\Tasks\{3858DA93-C458-467E-89AB-AD4E5B22998C}
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.

#5

dobra, zrobione, wielkie dzięki za pomoc