Istartsurf - sam sie instaluje

**Posty:** 3 · przez **mreyoo** 10 Lip 2015, 11:47

Witam, mam problem z istartsurf. Sam sie instaluje pomimo używania AdwCleanera. Instaluje sie razem z toną innych programów. Moglibyście mi z tym pomóc? Od dwóch dni sie męcze z tymi nie daje rady...

Logi z FRST w załącznikach.

**Posty:** 4765 · przez **ordynat** 10 Lip 2015, 11:49

1) Spróbuj odinstalować:

istartsurf uninstall (HKLM-x32\...\istartsurf uninstall) (Version: - istartsurf) <==== ATTENTION
SmartWeb (HKLM-x32\...\SmartWeb) (Version: 8.0.9 - SoftBrain Technologies Ltd.) <==== ATTENTION
YAC(Yet Another Cleaner!) (HKLM-x32\...\iSafe) (Version: - ELEX DO BRASIL cenzura!ÇÕES LTDA) <==== ATTENTION

2) Otwórz Notatnik i wklej w nim:

Task: {20321FE2-6D7C-43A4-A142-F64B5DB754CC} - System32\Tasks\SmartWeb Upgrade Trigger Task => C:\Users\Domek\AppData\Local\SmartWeb\SmartWebHelper.exe [2015-02-17] (SoftBrain Technologies Ltd.) <==== ATTENTION
Task: {29D2EDF2-CEF1-4D98-8C4E-08B6A71965A5} - System32\Tasks\{667D2367-D973-47BC-BB8C-AD2751CFA20D} => pcalua.exe -a "C:\Program Files (x86)\YouTube Accelerator\YTAUninstall.exe"
Task: {3341EC28-29F5-4415-B903-0B5C381C687D} - System32\Tasks\{88434CE1-6E7B-464D-95C6-758906F2C037} => pcalua.exe -a C:\Users\Domek\HijackThis(12030).exe -d C:\Users\Domek
Task: {3C8DFBA8-CBD6-489C-8B76-2DD4AD7E1C69} - System32\Tasks\{61822575-17D8-4753-BA18-F4DB1F766F5D} => pcalua.exe -a "C:\Program Files (x86)\Go HD\Uninstall.exe" -c /fcp=1
Task: {C7C99CC5-B425-47D5-9F7D-251E46044EF7} - \Oxy Updater No Task File <==== ATTENTION
Task: {D625B19B-A695-41A1-BE74-2E55926D7386} - System32\Tasks\{4062C2CA-E536-4395-8086-E3103B78BA8B} => pcalua.exe -a C:\Windows\IsUninst.exe -c -f"d:\mateusz\gry\Settlerki III GOLD\Uninst.isu" -x -c"d:\mateusz\gry\Settlerki III GOLD\install\itools.dll"
Task: {E77FF60F-01FF-4372-8758-FD189561FE2E} - System32\Tasks\ChronicBeats => c:\programdata\{751156ed-5c29-05b8-7511-156ed5c25bb5}\gamesetup.exe <==== ATTENTION
Task: C:\Windows\Tasks\ChronicBeats.job => c:\programdata\{751156ed-5c29-05b8-7511-156ed5c25bb5}\gamesetup.exe <==== ATTENTION
C:\Users\Domek\AppData\Local\SmartWeb
C:\Program Files (x86)\YouTube Accelerator
c:\programdata\{751156ed-5c29-05b8-7511-156ed5c25bb5}
2015-07-10 00:31 - 2015-07-10 00:31 - 00263680 _____ () C:\Users\Domek\AppData\Roaming\31E2A7A0-1436376867-11B2-8000-9E19DA9B3988\knsbC70E.tmp
2015-07-08 19:35 - 2015-07-08 19:35 - 00165376 _____ () C:\Users\Domek\AppData\Roaming\31E2A7A0-1436376867-11B2-8000-9E19DA9B3988\hnso3389.tmp
2015-07-08 19:35 - 2015-07-08 19:35 - 00199168 _____ () C:\Users\Domek\AppData\Roaming\31E2A7A0-1436376867-11B2-8000-9E19DA9B3988\jnsy1C4F.tmp
2015-07-10 00:34 - 2015-07-10 00:34 - 00217097 _____ () C:\Users\Domek\AppData\Local\Temp\nsw404E.tmp
2015-07-10 11:38 - 2015-07-09 10:33 - 03288720 _____ () C:\Users\Domek\AppData\Local\gmsd_pl_005010026\upgmsd_pl_005010026.exe
2015-07-10 11:38 - 2015-07-09 10:33 - 03987600 _____ () C:\Program Files (x86)\gmsd_pl_005010026\gmsd_pl_005010026.exe
2015-07-10 11:38 - 2015-07-10 11:38 - 00254464 _____ () C:\Users\Domek\AppData\Local\Temp\nsh93BC.tmp
2015-07-10 11:38 - 2015-07-10 11:38 - 03001344 _____ () C:\Users\Domek\AppData\Local\Temp\fsd9DB5.exe
2015-05-24 10:38 - 2015-04-16 10:49 - 00065696 ____N () C:\Program Files (x86)\Elex-tech\YAC\zlib1.dll
2015-05-24 10:38 - 2015-05-12 08:14 - 00176976 ____N () C:\Program Files (x86)\Elex-tech\YAC\tws\unrar.dll
2015-05-24 10:38 - 2015-05-12 08:14 - 00087744 ____N () C:\Program Files (x86)\Elex-tech\YAC\tws\unacev2.dll
2015-05-24 10:38 - 2015-01-13 06:31 - 00179200 ____N () C:\Program Files (x86)\Elex-tech\YAC\libpng.dll
C:\Program Files (x86)\Elex-tech
C:\Program Files (x86)\gmsd_pl_005010026
C:\Users\Domek\AppData\Local\gmsd_pl_005010026
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
C:\Users\Domek\AppData\Local\SmartWeb
C:\Program Files (x86)\MiuiTab
HKLM-x32\...\Run: [gmsd_pl_005010026] => C:\Program Files (x86)\gmsd_pl_005010026\gmsd_pl_005010026.exe [3987600 2015-07-09] ()
HKLM-x32\...\Run: [SmartWeb] => C:\Users\Domek\AppData\Local\SmartWeb\SmartWebHelper.exe [270368 2015-02-17] (SoftBrain Technologies Ltd.)
HKLM-x32\...\RunOnce: [upgmsd_pl_005010026.exe] => C:\Users\Domek\AppData\Local\gmsd_pl_005010026\upgmsd_pl_005010026.exe [3288720 2015-07-09] ()
ShortcutTarget: GTA San Andreas Crack.rar.lnk -> C:\ProgramData\{7cd34b8e-695e-a03e-7cd3-34b8e6952e39}\GTA San Andreas Crack.rar.exe (No File)
Startup: C:\Users\Domek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartWeb.lnk [2015-07-10]
ShortcutTarget: SmartWeb.lnk -> C:\Users\Domek\AppData\Local\SmartWeb\SmartWebHelper.exe (SoftBrain Technologies Ltd.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1436521037&z=aebdf9c8a66afe706f7843dg9z5ccq4w8odgce7oft&from=face&uid=HGSTXHTS545050A7E380_TM8513PY20BDDL20BDDLX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1436521037&z=aebdf9c8a66afe706f7843dg9z5ccq4w8odgce7oft&from=face&uid=HGSTXHTS545050A7E380_TM8513PY20BDDL20BDDLX&q={searchTerms}
HKU\S-1-5-21-3684802766-1061568966-2406521789-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1436521037&z=aebdf9c8a66afe706f7843dg9z5ccq4w8odgce7oft&from=face&uid=HGSTXHTS545050A7E380_TM8513PY20BDDL20BDDLX&q={searchTerms}
HKU\S-1-5-21-3684802766-1061568966-2406521789-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1436521037&z=aebdf9c8a66afe706f7843dg9z5ccq4w8odgce7oft&from=face&uid=HGSTXHTS545050A7E380_TM8513PY20BDDL20BDDLX&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL =
SearchScopes: HKLM-x32 -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://search.yac.mx/web/?q={searchTerms}&type=ds&from=yac&uid=hgstxhts545050a7e380_tm8513py20bddl20bddlx&ts=1436519218
SearchScopes: HKLM-x32 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://search.yac.mx/web/?q={searchTerms}&type=ds&from=yac&uid=hgstxhts545050a7e380_tm8513py20bddl20bddlx&ts=1436519218
SearchScopes: HKU\.DEFAULT -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://search.yac.mx/web/?q={searchTerms}&type=ds&from=yac&uid=hgstxhts545050a7e380_tm8513py20bddl20bddlx&ts=1436519218
SearchScopes: HKU\.DEFAULT -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://search.yac.mx/web/?q={searchTerms}&type=ds&from=yac&uid=hgstxhts545050a7e380_tm8513py20bddl20bddlx&ts=1436519218
SearchScopes: HKU\S-1-5-19 -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://search.yac.mx/web/?q={searchTerms}&type=ds&from=yac&uid=hgstxhts545050a7e380_tm8513py20bddl20bddlx&ts=1436519218
SearchScopes: HKU\S-1-5-19 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://search.yac.mx/web/?q={searchTerms}&type=ds&from=yac&uid=hgstxhts545050a7e380_tm8513py20bddl20bddlx&ts=1436519218
SearchScopes: HKU\S-1-5-20 -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://search.yac.mx/web/?q={searchTerms}&type=ds&from=yac&uid=hgstxhts545050a7e380_tm8513py20bddl20bddlx&ts=1436519218
SearchScopes: HKU\S-1-5-20 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://search.yac.mx/web/?q={searchTerms}&type=ds&from=yac&uid=hgstxhts545050a7e380_tm8513py20bddl20bddlx&ts=1436519218
SearchScopes: HKU\S-1-5-21-3684802766-1061568966-2406521789-1000 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=face&utm_campaign=install_ie&utm_content=ds&from=face&uid=HGSTXHTS545050A7E380_TM8513PY20BDDL20BDDLX&ts=1436521082&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3684802766-1061568966-2406521789-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=face&utm_campaign=install_ie&utm_content=ds&from=face&uid=HGSTXHTS545050A7E380_TM8513PY20BDDL20BDDLX&ts=1436521082&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3684802766-1061568966-2406521789-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=face&utm_campaign=install_ie&utm_content=ds&from=face&uid=HGSTXHTS545050A7E380_TM8513PY20BDDL20BDDLX&ts=1436521082&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3684802766-1061568966-2406521789-1000 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=face&utm_campaign=install_ie&utm_content=ds&from=face&uid=HGSTXHTS545050A7E380_TM8513PY20BDDL20BDDLX&ts=1436521082&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3684802766-1061568966-2406521789-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=face&utm_campaign=install_ie&utm_content=ds&from=face&uid=HGSTXHTS545050A7E380_TM8513PY20BDDL20BDDLX&ts=1436521082&type=default&q={searchTerms}
BHO-x32: LuckyTab Class -> {51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} -> C:\Program Files (x86)\MiuiTab\SupTab.dll [2015-06-24] (Thinknice Co. Limited)
BHO-x32: On Stage -> {aff87634-f4a9-42bc-b2dc-be240584d095} -> C:\Program Files (x86)\On Stage\Extensions\aff87634-f4a9-42bc-b2dc-be240584d095.dll No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
OPR Extension: (Go HD) - C:\Users\Domek\AppData\Roaming\Opera Software\Opera Stable\Extensions\akhnhcaegnngfkimifphjbpeeeaidejk [2014-07-18]
OPR Extension: (On Stage) - C:\Users\Domek\AppData\Roaming\Opera Software\Opera Stable\Extensions\pfgjkiamaakjjjaalggclbfapojejene [2015-07-08]
R2 IHProtect Service; C:\Program Files (x86)\MiuiTab\ProtectService.exe [125112 2015-06-24] (XTab system)
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [118048 2015-04-16] (Elex do Brasil cenzura!ções Ltda)
R2 nigisoli; C:\Users\Domek\AppData\Roaming\31E2A7A0-1436376867-11B2-8000-9E19DA9B3988\knsbC70E.tmp [263680 2015-07-10] () [File not signed]
R2 vicoqudu; C:\Users\Domek\AppData\Roaming\31E2A7A0-1436376867-11B2-8000-9E19DA9B3988\hnso3389.tmp [165376 2015-07-08] () [File not signed]
R2 zejytose; C:\Users\Domek\AppData\Roaming\31E2A7A0-1436376867-11B2-8000-9E19DA9B3988\jnsy1C4F.tmp [199168 2015-07-08] () [File not signed]
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
S2 insvc_1.10.0.14; "C:\Program Files (x86)\Infonaut_1.10.0.14\Service\insvc.exe" [X]
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [260344 2015-05-07] (Elex do Brasil cenzura!ções Ltda)
R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [108616 2015-04-16] (Elex do Brasil cenzura!ções Ltda)
R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [50944 2015-04-16] (Elex do Brasil cenzura!ções Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [93352 2015-05-22] (Elex do Brasil cenzura!ções Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [52392 2015-04-14] (Elex do Brasil cenzura!ções Ltda)
C:\Windows\System32\DRIVERS\iSafeNetFilter.sys
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 FairplayKD; \??\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [X]
S3 iSafeKrnlBoot; system32\DRIVERS\iSafeKrnlBoot.sys [X]
S1 wafd_1_10_0_19; system32\drivers\wafd_1_10_0_19.sys [X]
C:\ProgramData\IHProtectUpDate
C:\ProgramData\WindowsMangerProtect
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.
Powstanie plik fixlog.txt.
Daj ten log.

Zrób nowe logi FRST.

(ZAJRZĘ TU DOPIERO ZA KILKA GODZIN)
.

**Posty:** 3 · przez **mreyoo** 10 Lip 2015, 11:53

ordynat napisał(a):1) Spróbuj odinstalować:
istartsurf uninstall (HKLM-x32\...\istartsurf uninstall) (Version: - istartsurf) <==== ATTENTION

Odinstalowałem, co dalej?

ordynat napisał(a):1) Spróbuj odinstalować:
SmartWeb (HKLM-x32\...\SmartWeb) (Version: 8.0.9 - SoftBrain Technologies Ltd.) <==== ATTENTION

Podczas próby wyskakuje komunikat "Nie masz wystarczających uprawnień do odinstalowania systemu SmartWeb. Skontaktuj się z administratorem systemu". Problem w tym, że mam uprawnienia administratora...

**Posty:** 4765 · przez **ordynat** 10 Lip 2015, 12:06

za szybko działasz, jak na moje możliwości

dalsze zalecenia będą w moim poprzednim poście, ale to chwilę jeszcze potrwa.
.

Autor postu otrzymał pochwałę

**Posty:** 3 · przez **mreyoo** 10 Lip 2015, 22:28

Zrobiłem fix'a i jak narazie jest dobrze (zwykle od razu po włączeniu wyskakiwały instalatory różnych śmieci).

Logi + Fixlog w załacznikach

**Posty:** 4765 · przez **ordynat** 11 Lip 2015, 03:10

Otwórz Notatnik i wklej w nim:

Task: {054B4758-FFCF-4CF8-876A-77970B3C6E5C} - System32\Tasks\{C2029123-ADD3-455E-AFB4-6B95269CF0ED} => pcalua.exe -a "C:\Program Files (x86)\Common Files\Nero\Nero ProductInstaller 4\SetupX.exe" -c REMOVESERIALNUMBER="XM02-508X-MHAT-19WU-9Z3Z-0CH0-3U6E-85W5-MMHH-6647-1Z5L-7M8C-0U45-758P-0000"
C:\Users\Domek\AppData\Local\Akamai\netsession_win.exe
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Akamai NetSession Interface" /f
ShortcutTarget: GTA San Andreas Crack.rar.lnk -> C:\ProgramData\{7cd34b8e-695e-a03e-7cd3-34b8e6952e39}\GTA San Andreas Crack.rar.exe (No File)
C:\Program Files (x86)\predm
C:\Users\Domek\AppData\Local\951
HKU\S-1-5-21-3684802766-1061568966-2406521789-1000\...\Run: [GoogleChromeAutoLaunch_07571144BD12A0EB4925EEF4057ED17D] => "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window
C:\Program Files (x86)\Crossbrowse
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.

----------------------
Jeśli będzie OK, to będziemy kończyć:
Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix.
przez SHIFT+DEL usuń pozostały folder C:\FRST.

W Adw-Cleaner kliknij na przycisk Odinstaluj (UNINSTALL).

[color="#FF0000"]CHR dev: Chrome dev build detected! <======= ATTENTION[/color]

Odinstaluj tę dziurawą wersję Google Chrome.
Zainstaluj stąd > http://www.google.com/chrome/
.