Zmiana stron startowych. Wirus?

po każdym restarcie komputera zmienia mi sie strona startowa na jakies tam key-find. przeinstalowałem system zrecovery i nadal mam to samo. Pomocy. Daję loga z RSIT-a.

 

http://wklej.org/id/1640578/

Pobierz Farbar Recovery Scan Tool http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ zgodny z wersją systemu 32-bit lub 64-bit.

I wykonałem scan FRST oto logi:

 

http://wklej.org/id/1640618/

http://wklej.org/id/1640621/

http://wklej.org/id/1640623/

Odinstaluj Adobe Reader 9.1 MUI.Otwórz notatnik systemowy i wklej:

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com/web/?type=dsts=1424281175from=coruid=WDCXWD3200BPVT-22ZEST0_WD-WXL1A50H6425H6425q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com/web/?type=dsts=1424281175from=coruid=WDCXWD3200BPVT-22ZEST0_WD-WXL1A50H6425H6425q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com/web/?type=dsts=1424281175from=coruid=WDCXWD3200BPVT-22ZEST0_WD-WXL1A50H6425H6425q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com/web/?type=dsts=1424281175from=coruid=WDCXWD3200BPVT-22ZEST0_WD-WXL1A50H6425H6425q={searchTerms}
HKU\S-1-5-21-1043248053-4207566897-824170273-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1043248053-4207566897-824170273-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com/web/?type=dsppts=1424281232from=coruid=WDCXWD3200BPVT-22ZEST0_WD-WXL1A50H6425H6425q={searchTerms}
HKU\S-1-5-21-1043248053-4207566897-824170273-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com/web/?type=dsppts=1424281232from=coruid=WDCXWD3200BPVT-22ZEST0_WD-WXL1A50H6425H6425q={searchTerms}
SearchScopes: HKU\S-1-5-21-1043248053-4207566897-824170273-1001 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.key-find.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=WDCXWD3200BPVT-22ZEST0_WD-WXL1A50H6425H6425ts=1424281277type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-1043248053-4207566897-824170273-1001 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.key-find.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=WDCXWD3200BPVT-22ZEST0_WD-WXL1A50H6425H6425ts=1424281277type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-1043248053-4207566897-824170273-1001 - {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.key-find.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=WDCXWD3200BPVT-22ZEST0_WD-WXL1A50H6425H6425ts=1424281277type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-1043248053-4207566897-824170273-1001 - {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.key-find.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=WDCXWD3200BPVT-22ZEST0_WD-WXL1A50H6425H6425ts=1424281277type=defaultq={searchTerms}
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
2015-02-18 18:42 - 2015-02-18 18:42 - 00000000 ____ D () C:\ProgramData\IHProtectUpDate
2015-02-18 18:41 - 2015-02-18 19:11 - 00000000 ____ D () C:\Program Files (x86)\XTab
2015-02-18 18:40 - 2015-02-18 19:11 - 00000000 ____ D () C:\ProgramData\WindowsMangerProtect
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.