Prośba o pomoc w odinstalowaniu fast start

**Posty:** 11 · przez **Agaetc** 10 Sie 2015, 16:00

Witajcie,

Wielka prośba o pomoc w usunięciu wirusa Fast Start, kompletnie uniemożliwił korzystanie z laptopa :|

Z góry bardzo dziękuję za pomoc!

**Posty:** 4765 · przez **ordynat** 10 Sie 2015, 17:27

1) Odinstaluj ten program:
istartsurf uninstall (HKLM-x32\...\istartsurf uninstall) (Version: - istartsurf) <==== ATTENTION

2) Użyj Adw-Cleaner http://www.programosy.pl/program,adwcleaner.html
najpierw kliknij na SZUKAJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ (CLEANING), to kliknij na niego.
Pokaż raport z niego C:\AdwCleaner\AdwCleaner[S].txt

3) Otwórz Notatnik i wklej w nim:

CustomCLSID: HKU\S-1-5-21-1951255329-4283516015-3182968858-1001_Classes\CLSID\{74F5CC00-49A9-11CF-A2F9-444553540000}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD LT 2014\pl-PL\acadltficn.dll No File
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
C:\Program Files (x86)\MiuiTab
Task: {018E53FC-CE6E-4A9C-A823-8D67E865ECBA} - System32\Tasks\{FD9D3691-B9CA-4D80-ACAD-F9FAACFE1070} => pcalua.exe -a C:\MANTIS\PROG\EDITMINI.EXE -d C:\MANTIS\PROG
Task: {A8A8C73A-8156-4865-9A5F-BF06B12FDBB3} - System32\Tasks\{03AF7871-BB33-4821-A2B6-D8AE67F2C7C2} => pcalua.exe -a "C:\Users\Michal\AppData\Local\Temp\Temp1_Autodesk AutoCAD 2005-Keygen.zip\Autodesk AutoCAD 2005-Keygen.exe"
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hppp&ts=1438890206&z=0a19d74f134dbc5d71e3688g9zcc9b5bctfeeg1c9m&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hppp&ts=1438890206&z=0a19d74f134dbc5d71e3688g9zcc9b5bctfeeg1c9m&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1438890165&z=80c6d47387337887165c44cg7z5c2bdbet2eae6taq&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hppp&ts=1438890206&z=0a19d74f134dbc5d71e3688g9zcc9b5bctfeeg1c9m&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hppp&ts=1438890206&z=0a19d74f134dbc5d71e3688g9zcc9b5bctfeeg1c9m&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1438890165&z=80c6d47387337887165c44cg7z5c2bdbet2eae6taq&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&q={searchTerms}
HKU\S-1-5-21-1951255329-4283516015-3182968858-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hppp&ts=1438890206&z=0a19d74f134dbc5d71e3688g9zcc9b5bctfeeg1c9m&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS
HKU\S-1-5-21-1951255329-4283516015-3182968858-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1438890165&z=80c6d47387337887165c44cg7z5c2bdbet2eae6taq&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&q={searchTerms}
HKU\S-1-5-21-1951255329-4283516015-3182968858-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1438890165&z=80c6d47387337887165c44cg7z5c2bdbet2eae6taq&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&q={searchTerms}
HKU\S-1-5-21-1951255329-4283516015-3182968858-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hppp&ts=1438890206&z=0a19d74f134dbc5d71e3688g9zcc9b5bctfeeg1c9m&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-1951255329-4283516015-3182968858-1001 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&ts=1438890221&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1951255329-4283516015-3182968858-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&ts=1438890221&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1951255329-4283516015-3182968858-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&ts=1438890221&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1951255329-4283516015-3182968858-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&ts=1438890221&type=default&q={searchTerms}
BHO-x32: GoodTab Class -> {1F91A9A1-01BA-4c81-863D-3BA0751E1419} -> C:\Program Files (x86)\MiuiTab\SupTab.dll [2015-08-04] (Good Co. Limited)
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: istartsurf
FF SelectedSearchEngine: istartsurf
FF SearchPlugin: C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\sc0l9298.default\searchplugins\istartsurf.xml [2015-08-10]
FF Extension: Default SearchProtected - C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\sc0l9298.default\Extensions\defsearchp@gmail.com [2015-08-06]
FF Extension: deskCut - C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\sc0l9298.default\Extensions\deskCutv2@gmail.com [2015-08-06]
FF HKLM-x32\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\sc0l9298.default\extensions\defsearchp@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\sc0l9298.default\extensions\deskCutv2@gmail.com
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\firefox.cfg [2015-08-07] <==== ATTENTION
R2 IHProtect Service; C:\Program Files (x86)\MiuiTab\ProtectService.exe [125112 2015-08-04] (XTab system)
R2 WindowsMangerProtect; C:\ProgramData\UWinManProU\ProtectWindowsManager.exe [708264 2015-08-06] (DTools LIMITED) <==== ATTENTION
C:\ProgramData\UWinManProU
2015-08-06 21:44 - 2015-08-06 21:44 - 00000000 ____D C:\ProgramData\Installations
2015-08-06 21:43 - 2015-08-06 21:44 - 00000000 ____D C:\ProgramData\UWinManProU
2015-08-06 21:43 - 2015-08-06 21:43 - 00000000 ____D C:\Users\Michal\AppData\Roaming\istartsurf
2015-08-06 21:43 - 2015-08-06 21:43 - 00000000 ____D C:\ProgramData\IHProtectUpDate
2015-08-06 21:43 - 2015-08-06 21:43 - 00000000 ____D C:\Program Files (x86)\TermCoach_1.10.0.21
2015-08-06 21:43 - 2015-08-06 21:43 - 00000000 ____D C:\Program Files (x86)\MiuiTab
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.
Powstanie plik fixlog.txt.
Daj ten log.

4) Zrób nowe logi FRST

5) Napisz, czy problem znikł?
.

**Posty:** 11 · przez **Agaetc** 10 Sie 2015, 22:26

Na wstępie, dziękuję za pomoc. Przesyłam fixlog, (i na wszelki wypadek, pozostałe, nowo wygenerowane logi). Na razie problem nie zniknął

**Posty:** 4765 · przez **ordynat** 11 Sie 2015, 09:28

Brak raportu z Adw-Cleaner'a.

Log FRST.txt - jest tylko jego końcówka.

Uzupełnij to.

Otwórz Notatnik i wklej w nim:

ShortcutWithArgument: C:\Users\Michal\Desktop\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.22find.com/?utm_source=b&utm_medium=prs&from=prs&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&ts=1362175137
ShortcutWithArgument: C:\Users\Michal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.22find.com/?utm_source=b&utm_medium=prs&from=prs&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&ts=1362175137
ShortcutWithArgument: C:\Users\Michal\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.22find.com/?utm_source=b&utm_medium=prs&from=prs&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&ts=1362175137
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
C:\Users\Michal\Music\HP LaunchBox Manager.lnk
C:\Windows\Installer\{5A847522-375C-4D05-BD3D-88C450CC047F}
C:\Users\Michal\Desktop\Michał\Pendrive\Dokumenty\Inventor Samples.lnk
C:\Users\Michal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserDefender\Uninstall BrowserDefender.lnk
C:\ProgramData\BrowserDefender
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.
Powstanie plik fixlog.txt.
Daj ten log.
.

**Posty:** 11 · przez **Agaetc** 11 Sie 2015, 12:56

Wygląda na to, że już jest ok. Reklamy zniknęły. W załączeniu fixlog.

BARDZO, BARDZO dziękuję za pomoc!

Dodano Dzisiaj, 13:10:

**Posty:** 4765 · przez **ordynat** 11 Sie 2015, 15:44

Otwórz Notatnik i wklej w nim:

SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://pl.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
S2 tcsvc_1.10.0.21; "C:\Program Files (x86)\TermCoach_1.10.0.21\Service\tcsvc.exe" [X]
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
R1 tcfd_vt_1_10_0_21; C:\Windows\System32\drivers\tcfd_vt_1_10_0_21.sys [61312 2015-07-28] (TermCoach)
C:\Windows\System32\drivers\tcfd_vt_1_10_0_21.sys
C:\Windows\system32\Drivers\tcfd_vw_1_10_0_21.sys
C:\Users\Michal\Downloads\Nokia-PC-Suite-12931-dp.exe
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.

Potem kończymy:
Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix.
przez SHIFT+DEL usuń pozostały folder C:\FRST.

W Adw-Cleaner kliknij na przycisk Odinstaluj (UNINSTALL).

.

**Posty:** 11 · przez **Agaetc** 12 Sie 2015, 16:51

Wrócił! Przepraszam, to moja wina. Niechcący próbowałam ściągnąć jakiś program. Zanim wszystko anulowałam, był już z powrotem. Nie mogę nawet napisać spokojnie postu, bo zamyka mi forum. Pomożesz?

Dodano Dzisiaj, 17:03:

**Posty:** 4765 · przez **ordynat** 12 Sie 2015, 18:16

Otwórz Notatnik i wklej w nim:

C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de
C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de
C:\ProgramData\aWinManProa
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
C:\Program Files (x86)\MiuiTab
HKU\S-1-5-21-1951255329-4283516015-3182968858-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1439390240&z=2e6e032342eea06685f0588g6z6cft1c5t0e2gawdb&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1439390240&z=2e6e032342eea06685f0588g6z6cft1c5t0e2gawdb&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1439390240&z=2e6e032342eea06685f0588g6z6cft1c5t0e2gawdb&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1439390240&z=2e6e032342eea06685f0588g6z6cft1c5t0e2gawdb&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1439390240&z=2e6e032342eea06685f0588g6z6cft1c5t0e2gawdb&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1439390240&z=2e6e032342eea06685f0588g6z6cft1c5t0e2gawdb&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1439390240&z=2e6e032342eea06685f0588g6z6cft1c5t0e2gawdb&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1439390240&z=2e6e032342eea06685f0588g6z6cft1c5t0e2gawdb&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1439390240&z=2e6e032342eea06685f0588g6z6cft1c5t0e2gawdb&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&q={searchTerms}
HKU\S-1-5-21-1951255329-4283516015-3182968858-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1439390240&z=2e6e032342eea06685f0588g6z6cft1c5t0e2gawdb&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1439390240&z=2e6e032342eea06685f0588g6z6cft1c5t0e2gawdb&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1439390240&z=2e6e032342eea06685f0588g6z6cft1c5t0e2gawdb&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1951255329-4283516015-3182968858-1001 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&ts=1439390284&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1951255329-4283516015-3182968858-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&ts=1439390284&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1951255329-4283516015-3182968858-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&ts=1439390284&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1951255329-4283516015-3182968858-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&ts=1439390284&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1951255329-4283516015-3182968858-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS&ts=1439390284&type=default&q={searchTerms}
BHO-x32: GoodTab Class -> {1F91A9A1-01BA-4c81-863D-3BA0751E1419} -> C:\Program Files (x86)\MiuiTab\SupTab.dll [2015-08-07] (Good Co. Limited)
BHO-x32: Jungle Net -> {dcfb5bfe-1f58-4b1d-96a7-3c7bbae51b36} -> C:\Program Files (x86)\Jungle Net\Extensions\dcfb5bfe-1f58-4b1d-96a7-3c7bbae51b36.dll [2015-08-12] ()
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: istartsurf
FF SelectedSearchEngine: istartsurf
FF Homepage: hxxp://www.istartsurf.com/?type=hp&ts=1439390240&z=2e6e032342eea06685f0588g6z6cft1c5t0e2gawdb&from=cor&uid=TOSHIBAXMQ01ABD075_82C4S02HSXX82C4S02HS
C:\Program Files (x86)\Jungle Net
FF SearchPlugin: C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\sc0l9298.default\searchplugins\istartsurf.xml [2015-08-12]
FF Extension: Default SearchProtected - C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\sc0l9298.default\Extensions\defsearchp@gmail.com [2015-08-12]
FF Extension: deskCut - C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\sc0l9298.default\Extensions\deskCutv2@gmail.com [2015-08-12]
FF Extension: Jungle Net - C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\sc0l9298.default\Extensions\{16a9d1d5-7c36-4224-8574-0add20588a52}.xpi [2015-08-12]
FF HKLM-x32\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\sc0l9298.default\extensions\defsearchp@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\sc0l9298.default\extensions\deskCutv2@gmail.com
R2 IHProtect Service; C:\Program Files (x86)\MiuiTab\ProtectService.exe [125112 2015-08-07] (XTab system)
R2 Service Mgr JungleNet; C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe [1151240 2015-08-12] ()
R2 Update Mgr JungleNet; C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe [1076488 2015-08-12] ()
R2 WindowsMangerProtect; C:\ProgramData\aWinManProa\ProtectWindowsManager.exe [708264 2015-08-12] (DTools LIMITED) <==== ATTENTION
S2 tcsvc_1.10.0.21; "C:\Program Files (x86)\TermCoach_1.10.0.21\Service\tcsvc.exe" [X]
C:\Program Files (x86)\TermCoach_1.10.0.21
C:\Users\Michal\AppData\Roaming\istartsurf
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.
Powstanie plik fixlog.txt.
Daj ten log.

Zrób nowe logi FRST.
.

**Posty:** 7 · przez **radzia** 12 Sie 2015, 21:40

Zrobione, wklejam logi:

**Posty:** 11 · przez **Agaetc** 16 Sie 2015, 21:12

Jest ok, reklamy zniknęły - wklejam logi.

**Posty:** 4765 · przez **ordynat** 16 Sie 2015, 22:22

Odinstaluj program TermCoach 1.10.0.21

Otwórz Notatnik i wklej w nim:

2015-07-28 23:43 - 2015-07-28 23:43 - 00061312 _____ (TermCoach) C:\Windows\system32\Drivers\tcfd_vt_1_10_0_21.sys
2015-07-28 23:43 - 2015-07-28 23:43 - 00057728 _____ (TermCoach) C:\Windows\system32\Drivers\tcfd_vw_1_10_0_21.sys
R1 tcfd_vt_1_10_0_21; C:\Windows\System32\drivers\tcfd_vt_1_10_0_21.sys [61312 2015-07-28] (TermCoach)
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.
Powstanie plik fixlog.txt.
Daj ten log.
.
Zrób nowe logi FRST.
.

**Posty:** 11 · przez **Agaetc** 16 Sie 2015, 23:16

W załączniku nowe pliki.

**Posty:** 4765 · przez **ordynat** 17 Sie 2015, 06:47

Chyba możemy kończyć:
Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix.
przez SHIFT+DEL usuń pozostały folder C:\FRST.

W Adw-Cleaner kliknij na przycisk Odinstaluj (UNINSTALL).

.

**Posty:** 11 · przez **Agaetc** 17 Sie 2015, 16:12

Ok, zrobione, działa bez zarzutu! Bardzo, bardzo dziękuję za pomoc!

Kto jest na forum