Wander burst ads - pomoc w usunięciu

[ravena]

Załączam logi. Z góry dziękuję za pomoc.

[ordynat]

1) Odinstaluj ten program:

istartsurf uninstall (HKLM-x32\...\istartsurf uninstall) (Version: - istartsurf) <==== ATTENTION

2) Adw-Cleaner: najpierw kliknij na SZUKAJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ (CLEANING), to kliknij na niego.

3) Otwórz Notatnik i wklej w nim:

C:\Program Files (x86)\MiuiTab
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
BHO-x32: Wander Burst -> {0f4e02f8-f10e-493d-a1a7-3aed7ba7b110} -> C:\Program Files (x86)\Wander Burst\Extensions\0f4e02f8-f10e-493d-a1a7-3aed7ba7b110.dll No File
C:\Program Files (x86)\Wander Burst
BHO-x32: LuckyTab Class -> {51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} -> C:\Program Files (x86)\MiuiTab\SupTab.dll [2015-06-16] (Thinknice Co. Limited)
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: istartsurf
FF SelectedSearchEngine: istartsurf
FF SearchPlugin: C:\Users\ASus\AppData\Roaming\Mozilla\Firefox\Profiles\8ts8b5fp.default\searchplugins\istartsurf.xml [2015-07-29]
FF Extension: QuickSearch - C:\Users\ASus\AppData\Roaming\Mozilla\Firefox\Profiles\8ts8b5fp.default\Extensions\searchffv2@gmail.com [2015-06-21]
FF Extension: Search Enginer - C:\Users\ASus\AppData\Roaming\Mozilla\Firefox\Profiles\8ts8b5fp.default\Extensions\sweetsearch@gmail.com [2015-06-21]
FF Extension: Wander Burst - C:\Users\ASus\AppData\Roaming\Mozilla\Firefox\Profiles\8ts8b5fp.default\Extensions\{40f1cb57-fd85-4b63-aa7e-79980e57099c}.xpi [2015-07-29]
FF HKLM-x32\...\Firefox\Extensions: [searchffv2@gmail.com] - C:\Users\ASus\AppData\Roaming\Mozilla\Firefox\Profiles\8ts8b5fp.default\extensions\searchffv2@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [sweetsearch@gmail.com] - C:\Users\ASus\AppData\Roaming\Mozilla\Firefox\Profiles\8ts8b5fp.default\extensions\sweetsearch@gmail.com
R2 IHProtect Service; C:\Program Files (x86)\MiuiTab\ProtectService.exe [125112 2015-06-16] (XTab system)
C:\Users\UpdatusUser\Desktop\Kurka Wodna 2.lnk
C:\Users\ASus\Desktop\PITy 2014.lnk
C:\Users\ASus\AppData\Local\Microsoft\Windows\GameExplorer\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}\PlayTasks\1\The Sims™ 2 Warsztat.lnk
C:\Users\ASus\AppData\Local\Microsoft\Windows\GameExplorer\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}\PlayTasks\0\Uruchom grę The Sims™ 2 Cztery pory roku.lnk
C:\ProgramData\Media Center Programs\Horsez2Option.lnk
C:\ProgramData\Media Center Programs\Horsez2.lnk
C:\ProgramData\Microsoft\Windows\GameExplorer\{F715F7A4-67BA-11DD-F4B4-C04D56CFF2F4}\PlayTasks\0\Uruchom grę Laura Hobby - Mistrzyni jazdy konnej.lnk
C:\ProgramData\Microsoft\Windows\GameExplorer\{F715F7A4-67BA-11DD-F4B4-C04D56CFF2F4}\PlayTasks\1\Narzędzie konfiguracyjne.lnk
C:\ProgramData\Microsoft\Windows\GameExplorer\{F715F7A4-67BA-11DD-F4B4-C04D56CFF2F4}\PlayTasks\2\Instrukcja.lnk
C:\ProgramData\Microsoft\Windows\GameExplorer\{F715F7A4-67BA-11DD-F4B4-C04D56CFF2F4}\PlayTasks\3\Informacje.lnk
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.
Powstanie plik fixlog.txt.
Daj ten log.

Zrób nowe logi FRST - już bez Shortcut.
.

[ravena]

Wykonane

[ordynat]

Otwórz Notatnik i wklej w nim:

Task: {B3D5053F-FC9B-462D-9317-47CA5CD75651} - System32\Tasks\{919D85BA-17A2-4749-82EE-AF58FD7180CA} => pcalua.exe -a C:\Users\ASus\AppData\Roaming\istartsurf\UninstallManager.exe -c -ptid=cor
Task: {E537FCBD-80FD-4C98-A67F-69D6F6018F33} - System32\Tasks\{9A44926A-79B2-44D7-82C0-81A76AEC7406} => pcalua.exe -a E:\Autorun.exe -d E:\
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1434910769&z=2f33ab6a62b25c395b6eb99g9z1ccz6t1gde1meq1m&from=cor&uid=ST1000LM024XHN-M101MBB_S32XJ9EF457629&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1434910769&z=2f33ab6a62b25c395b6eb99g9z1ccz6t1gde1meq1m&from=cor&uid=ST1000LM024XHN-M101MBB_S32XJ9EF457629&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1434910769&z=2f33ab6a62b25c395b6eb99g9z1ccz6t1gde1meq1m&from=cor&uid=ST1000LM024XHN-M101MBB_S32XJ9EF457629&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1434910769&z=2f33ab6a62b25c395b6eb99g9z1ccz6t1gde1meq1m&from=cor&uid=ST1000LM024XHN-M101MBB_S32XJ9EF457629&q={searchTerms}
SearchScopes: HKU\S-1-5-21-379229587-4176076998-1202267418-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=ST1000LM024XHN-M101MBB_S32XJ9EF457629&ts=1434910830&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-379229587-4176076998-1202267418-1003 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=ST1000LM024XHN-M101MBB_S32XJ9EF457629&ts=1434910830&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-379229587-4176076998-1202267418-1003 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=ST1000LM024XHN-M101MBB_S32XJ9EF457629&ts=1434910830&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-379229587-4176076998-1202267418-1003 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.istartsurf.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=ST1000LM024XHN-M101MBB_S32XJ9EF457629&ts=1434910830&type=default&q={searchTerms}
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.


----------------------
Jeśli będzie OK, to będziemy kończyć:
Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix.
przez SHIFT+DEL usuń pozostały folder C:\FRST.

W Adw-Cleaner kliknij na przycisk Odinstaluj (UNINSTALL).

.
=================

Jeśli natomiast problem nie zniknie, to przeinstalujesz przeglądarkę, na której to jeszcze będzie.
.