Uninstall:
do-search uninstall
McAfee WebAdvisor
Use AdwCleaner, Scan / Search and Clean / Delete option:
http://www.bleepingcomputer.com/download/adwcleaner/ Next to frst.exe, create the Fixlist.txt file with the contents:
Task: {292A3D02-281E-4E1D-AB57-EF20C29902E0} - \ Microsoft \ Windows \ Setup \ gwx \ launchtrayprocess -> No file No file No file No file No file No file No file "c: \ windows \ system32 \ launchwinapp.exe" hxxp: //ui.skype .com / u / 0 / 7.7.64.103 / en / abandoninstall? page = tsBing
Task: {8C63EB0A-E954-44DC-9C12-E9D5D9D9FB17} - \ Microsoft \ Windows \ Setup \ GWXTriggers \ OutOfIdle-5d -> No file No file No file No file No file No file C: \ Program Files (x86) \ AVG \ AVG PC TuneUp \ tuscanx.exe
Task: {FC28CAA2-EDEB-48E0-8154-14E9DEFD47DE} - \ Microsoft \ Windows \ Setup \ GWXTriggers \ Time-5d -> No file C: \ Users \ user \ AppData \ Local \ Microsoft \ BingSvc \ BingSvc.exe [144008 2015 -11-05] ((C) 2015 Microsoft Corporation)
HKU \ S-1-5-21-761739301-949621395-4261713747-1000 \ ... \ MountPoints2: {03f35ced-fa29-11e7-9dd6-00269eead241} - "F: \ HiSuiteDownLoader.exe"
HKU \ S-1-5-18 \ ... \ Winlogon: [Shell] C: \ WINDOWS \ explorer.exe [3904296 Feb 2, 2018] (Microsoft Corporation) DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSERBM&pc=MSERT1
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSERBM&pc=MSERT1
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSERBM&pc=MSERT1
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSERBM&pc=MSERT1
SearchScopes: HKU\S-1-5-21-761739301-949621395-4261713747-1000 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSERBM&pc=MSERT1
SearchScopes: HKU\S-1-5-21-761739301-949621395-4261713747-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=ST500LM000-1EJ162_W763BRJZXXXXW763BRJZ&ts=1427205390&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-761739301-949621395-4261713747-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSERBM&pc=MSERT1
SearchScopes: HKU\S-1-5-21-761739301-949621395-4261713747-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=ST500LM000-1EJ162_W763BRJZXXXXW763BRJZ&ts=1427205390&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-761739301-949621395-4261713747-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=ST500LM000-1EJ162_W763BRJZXXXXW763BRJZ&ts=1427205390&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-761739301-949621395-4261713747-1000 -> {76BA8783-7101-4B7B-A962-FA8A40909276} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=ST500LM000-1EJ162_W763BRJZXXXXW763BRJZ&ts=1427205390&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-761739301-949621395-4261713747-1000 -> {FC9E2EE3-E40A-498D-8B6C-72EAC8B002C6} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=ST500LM000-1EJ162_W763BRJZXXXXW763BRJZ&ts=1427205390&type=default&q={searchTerms}
BHO: McAfee WebAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2018-01-19] (McAfee, Inc.)
BHO-x32: Brak nazwy -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> Brak pliku
BHO-x32: McAfee WebAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2018-01-19] (McAfee, Inc.)
FF NewTab: Mozilla\Firefox\Profiles\vuo8wsoy.default -> chrome://quick_start/content/index.html
FF SearchPlugin: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\vuo8wsoy.default\searchplugins\do-search.xml [2015-04-11]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\e10ssaffplg.xpi
FF Extension: (McAfee WebAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\e10ssaffplg.xpi [2017-12-07]
FF HKLM-x32\...\Firefox\Extensions: [searchengine@gmail.com] - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\vuo8wsoy.default\extensions\searchengine@gmail.com => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [istart_ffnt@gmail.com] - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\vuo8wsoy.default\extensions\istart_ffnt@gmail.com => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\e10ssaffplg.xpi
CHR Extension: (McAfee® WebAdvisor) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2018-03-11]
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [mbckjcfnjmoiinpgddefodcighgikkgn] - hxxps://clients2.google.com/service/update2/crx
S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X]
U3 idsvc; Brak ImagePath
2018-02-17 00:05 - 2017-06-28 10:59 - 000000000 _____ C:\end
C:\Windows\Tasks\{6693CFD4-12AA-44CD-955A-25FFA55EF550}.job
C:\Windows\Tasks\{CEC1AFDB-0025-42FC-908E-C29D1A3DF12B}.job
W FRST wybierz Napraw.
Zrob pelny skan przy pomocy Mbam i usun to co wykryje:
http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/ Uzyj
https://files-download.avg.com/util/tools/AVG_Remover.exe i zainstaluj Avg ponownie.
