Problem z usunięciem MyStart Search

Dla specjalistów Bezpieczeństwo
#1

Odinstalowałem to ustrojstwo i zmieniłem stronę główną, a to dalej jest i nie wiem jak się tego pozbyć. Używam Opery, ale reinstalacja chyba nic nie da , bo to się czepiło też Explorera. CCleaner, Smarty Uninstaller itp. tego nie wyszukują, a ja nie znalazłem tego na partycji. Antywirus niczego nie wykrył. POMOCY! 

#2

Pobierz Farbar Recovery Scan Tool http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ zgodny z wersją systemu 32-bit lub 64-bit.

#3

Addition: http://wklej.org/id/1636103/

 

FRST: http://wklej.org/id/1636104/

#4

Otwórz notatnik systemowy i wklej:

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hpppts=1423573006from=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hpppts=1423573006from=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=dsts=1423572955from=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=dsts=1423572955from=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hpppts=1423573006from=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hpppts=1423573006from=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=dsts=1423572955from=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=dsts=1423572955from=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182q={searchTerms}
HKU\S-1-5-21-3976532659-84095228-1553211927-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=dsppts=1423572529from=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182q={searchTerms}
HKU\S-1-5-21-3976532659-84095228-1553211927-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hpppts=1423573006from=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182
HKU\S-1-5-21-3976532659-84095228-1553211927-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=dsppts=1423572529from=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182q={searchTerms}
SearchScopes: HKU\S-1-5-21-3976532659-84095228-1553211927-1000 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dsppts=1423573006from=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182q={searchTerms}
SearchScopes: HKU\S-1-5-21-3976532659-84095228-1553211927-1000 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.mystartsearch.com/web/?utm_source=butm_medium=smtutm_campaign=install_ieutm_content=dsfrom=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182ts=1423573031type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-3976532659-84095228-1553211927-1000 - {1E14A608-99E6-4a01-9CE2-7D48F258EC1C} URL = http://www.mystartsearch.com/web/?utm_source=butm_medium=smtutm_campaign=install_ieutm_content=dsfrom=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182ts=1423573031type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-3976532659-84095228-1553211927-1000 - {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.mystartsearch.com/web/?utm_source=butm_medium=smtutm_campaign=install_ieutm_content=dsfrom=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182ts=1423573031type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-3976532659-84095228-1553211927-1000 - {2956942C-C7CA-4e14-9A49-22D420F96A8A} URL = http://www.mystartsearch.com/web/?utm_source=butm_medium=smtutm_campaign=install_ieutm_content=dsfrom=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182ts=1423573031type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-3976532659-84095228-1553211927-1000 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dsppts=1423573006from=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182q={searchTerms}
SearchScopes: HKU\S-1-5-21-3976532659-84095228-1553211927-1000 - {4C498608-00E1-4217-AFB4-7FA00B5937F3} URL = http://www.mystartsearch.com/web/?utm_source=butm_medium=smtutm_campaign=install_ieutm_content=dsfrom=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182ts=1423573031type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-3976532659-84095228-1553211927-1000 - {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.mystartsearch.com/web/?utm_source=butm_medium=smtutm_campaign=install_ieutm_content=dsfrom=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182ts=1423573031type=defaultq={searchTerms}
BHO-x32: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\XTab\SupTab.dll (Thinknice Co. Limited)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=scts=1423572445from=smtuid=WDCXWD1600JS-55MHB1_WD-WCANM637718277182
S2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [X]
2015-02-10 13:49 - 2015-02-11 20:54 - 00000000 ____ D () C:\Program Files (x86)\XTab
2015-02-10 13:49 - 2015-02-10 13:49 - 00000000 ____ D () C:\ProgramData\IHProtectUpDate
2015-02-10 13:48 - 2015-02-10 21:11 - 00000000 ____ D () C:\ProgramData\WindowsMangerProtect
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.

#5

Udało się! Bardzo dziękuję za pomoc :slight_smile:

#6

Skasuj folder C:\FRST

#7

Zrobione.