Problem z Uninstall Master, key-find, Strong Signal Ads

Dla specjalistów Bezpieczeństwo
#1

Witam serdecznie,

prosiłbym o pomoc w pozbyciu się tego dziadostwa,

przesyłam raporty:

http://www.wklej.org/id/1645529/

http://www.wklej.org/id/1645530/

 

Z góry dziękuję za pomoc:)

#2

Odinstaluj Strong Signal.Otwórz notatnik systemowy i wklej:

HKLM\...\Run: [] = [X]
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.key-find.com/?type=hpppts=1424780889from=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.key-find.com/?type=hpppts=1424780889from=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com/web/?type=dsts=1424780835from=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KXq={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com/web/?type=dsts=1424780835from=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KXq={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.key-find.com/?type=hpppts=1424780889from=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.key-find.com/?type=hpppts=1424780889from=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KX
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com/web/?type=dsts=1424780835from=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KXq={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com/web/?type=dsts=1424780835from=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KXq={searchTerms}
HKU\S-1-5-21-112370138-610362539-2953519362-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com/web/?type=dsppts=1424780889from=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KXq={searchTerms}
HKU\S-1-5-21-112370138-610362539-2953519362-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.key-find.com/?type=hpppts=1424780889from=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KX
HKU\S-1-5-21-112370138-610362539-2953519362-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.key-find.com/?type=hpppts=1424780889from=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KX
HKU\S-1-5-21-112370138-610362539-2953519362-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com/web/?type=dsppts=1424780889from=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KXq={searchTerms}
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-112370138-610362539-2953519362-1001 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.key-find.com/web/?type=dsppts=1424780889from=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KXq={searchTerms}
SearchScopes: HKU\S-1-5-21-112370138-610362539-2953519362-1001 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.key-find.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KXts=1424780926type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-112370138-610362539-2953519362-1001 - {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.key-find.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KXts=1424780926type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-112370138-610362539-2953519362-1001 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.key-find.com/web/?type=dsppts=1424780889from=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KXq={searchTerms}
SearchScopes: HKU\S-1-5-21-112370138-610362539-2953519362-1001 - {AECE46A7-23C4-4B2B-B805-0CBAA05A7546} URL = http://www.key-find.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KXts=1424780926type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-112370138-610362539-2953519362-1001 - {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.key-find.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=HGSTXHTS541010A9E680_140303JD1009CCJGBR8KXts=1424780926type=defaultq={searchTerms}
BHO-x32: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\XTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: Strong Signal - {c723a437-2eaf-466d-a95b-3fa0966bf88c} - C:\Program Files (x86)\Strong Signal\Extensions\c723a437-2eaf-466d-a95b-3fa0966bf88c.dll ()
FF DefaultSearchEngine: key-find
FF SelectedSearchEngine: key-find
FF SearchPlugin: C:\Users\olsza_000\AppData\Roaming\Mozilla\Firefox\Profiles\clwgszv3.default\searchplugins\key-find.xml
FF Extension: Strong Signal - C:\Users\olsza_000\AppData\Roaming\Mozilla\Firefox\Profiles\clwgszv3.default\Extensions\{d53d402a-1b39-4020-8066-3e40f3b55121}.xpi [2015-02-24]
FF HKLM-x32\...\Firefox\Extensions: [searchengine@gmail.com] - C:\Users\olsza_000\AppData\Roaming\Mozilla\Firefox\Profiles\clwgszv3.default\extensions\searchengine@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\olsza_000\AppData\Roaming\Mozilla\Firefox\Profiles\clwgszv3.default\extensions\fftoolbar2014@etech.com
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158896 2015-01-16] (XTab system)
R2 Service Mgr StrongSignal; C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugincontainer.exe [577272 2015-02-24] ()
R2 Update Mgr StrongSignal; C:\Program Files (x86)\Common Files\0780f478-67ce-4ec3-98db-39a65f4618ce\updater.exe [384760 2015-02-24] ()
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [487056 2015-02-24] (SysTool PasSame LIMITED)
2015-02-24 13:29 - 2015-02-24 13:29 - 00000000 ____ D () C:\ProgramData\IHProtectUpDate
2015-02-24 13:29 - 2015-02-24 13:29 - 00000000 ____ D () C:\Program Files\CCleaner
2015-02-24 13:28 - 2015-02-24 13:29 - 00000000 ____ D () C:\Program Files (x86)\XTab
2015-02-24 13:28 - 2015-02-24 13:28 - 00000000 ____ D () C:\ProgramData\WindowsMangerProtect
C:\ProgramData\uninstall3196344.exe
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.

#3

Zadziałało, dziękuję bardzo :slight_smile:

#4

Skasuj folder C:\FRST