Skocz do zawartości
WAŻNE - Użytkownicy uprawnieni do pomocy
WAŻNE - Zakładanie tematu: obowiązkowe logi
Nadchodzące zmiany w logowaniu

Plaga yoursites123

misiowykks

Przez misiowykks
w Dział pomocy doraźnej

Rekomendowane odpowiedzi

Pomoc jest darmowa, ale proszę rozważ przekazanie dotacji na utrzymanie serwisu: klik.
picasso

picasso

Opublikowano
Opublikowano

Tu jest także w Google Chrome niepożądane rozszerzenie Shortcuts for All Google™ produkujące przekierowania iktmmny.com. Do wdrożenia następujące operacje:

 

1. Deinstalacje:

- Klawisz z flagą Windows + X > Programy i funkcje > odinstaluj stare wersje i zbędniki: Google Talk Plugin (już nie działa), Java 7 Update 65 (64-bit), Java 8 Update 25, McAfee Security Scan Plus.

- Uruchom narzędzie Microsoftu: KLIK. Zaakceptuj > Wykryj problemy i pozwól mi wybrać poprawki do zastosowania > Odinstalowywanie > zaznacz na liście wpis Metric Collection SDK > Dalej.

 

2. Otwórz Notatnik i wklej w nim:

 

CloseProcesses:
CreateRestorePoint:
R2 WdMan; C:\ProgramData\eWdMe\WdMan.exe [333312 2015-12-04] (TFuns LIMITED) [File not signed]
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Witcher Enhanced Edition Director's Cut [GOG.com]\The Witcher Enhanced Edition Director's Cut.lnk -> D:\Gry\The Witcher Enhanced Edition Director's Cut\launcher.exe (CD Projekt Red) -> hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com\The Witcher 2 - Assassins of Kings Enhanced Edition\The Witcher 2 - Assassins of Kings Enhanced Edition.lnk -> D:\Gry\The Witcher 2 Enhanced Edition\Launcher.exe (CD Projekt RED) -> hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Duel of Champions Launcher\Duel of Champions Launcher.lnk -> D:\Gry\Duel of Champions\Launcher.exe (Ubisoft) -> hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
ShortcutWithArgument: C:\Users\Karol\Desktop\Launch The Witcher Enhanced Edition Director's Cut.lnk -> D:\Gry\The Witcher Enhanced Edition Director's Cut\launcher.exe (CD Projekt Red) -> hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
ShortcutWithArgument: C:\Users\Karol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
ShortcutWithArgument: C:\Users\Karol\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
ShortcutWithArgument: C:\Users\Karol\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
ShortcutWithArgument: C:\Users\Karol\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
ShortcutWithArgument: C:\Users\Karol\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
ShortcutWithArgument: C:\Users\Public\Desktop\Duel of Champions Launcher.lnk -> D:\Gry\Duel of Champions\Launcher.exe (Ubisoft) -> hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
ShortcutWithArgument: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
ShortcutWithArgument: C:\Users\Public\Desktop\The Witcher 2 - Assassins of Kings Enhanced Edition.lnk -> D:\Gry\The Witcher 2 Enhanced Edition\Launcher.exe (CD Projekt RED) -> hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.yoursites123.com/?type=sc&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B&q={searchTerms}
HKU\S-1-5-21-2774745869-3052220403-4266378736-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
HKU\S-1-5-21-2774745869-3052220403-4266378736-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
SearchScopes: HKU\S-1-5-21-2774745869-3052220403-4266378736-1001 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2774745869-3052220403-4266378736-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B&q={searchTerms}
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
CHR HomePage: Default -> hxxp://www.yoursites123.com/?type=hp&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B
CHR StartupUrls: Default -> "hxxp://www.yoursites123.com/?type=hp&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B"
CHR DefaultSearchURL: Default -> hxxp://www.yoursites123.com/web/?type=ds&ts=1449667856&z=79be82e91a60ba47b425c43g1z8z2tcqbq8m9b9waq&from=ient07021&uid=KINGSTONXSV300S37A120G_50026B773B04AA1B&q={searchTerms}
CHR DefaultSearchKeyword: Default -> yoursites123
CHR HKLM\...\Chrome\Extension: [jdiejbegdjikmehflknhkbieocmnogcf] - C:\Users\Karol\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdiejbegdjikmehflknhkbieocmnogcf.crx [2015-11-07]
CHR HKLM-x32\...\Chrome\Extension: [jdiejbegdjikmehflknhkbieocmnogcf] - C:\Users\Karol\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdiejbegdjikmehflknhkbieocmnogcf.crx [2015-11-07]
FF HKLM-x32\...\Firefox\Extensions: [sidebarff@gmail.com] - C:\Users\Karol\AppData\Roaming\Mozilla\Firefox\Profiles\dzd0bzkw.default\extensions\sidebarff@gmail.com
Task: {29D3E6EF-18B8-4F07-8499-96A8445FCF87} - System32\Tasks\{84B0CEE2-5532-4738-AE82-087E5C433953} => Firefox.exe hxxp://ui.skype.com/ui/0/7.8.80.102/pl/abandoninstall?page=tsProgressBar
Task: {2BD4E0E5-42D7-4432-9651-1D425BF51C1E} - System32\Tasks\{9C8C2E9A-B2C0-4B6D-BC47-AE0993DB2F8B} => Firefox.exe hxxp://ui.skype.com/ui/0/7.8.80.102/pl/abandoninstall?page=tsProgressBar
Task: {91981038-F753-4060-82F5-586B08BD34B3} - System32\Tasks\{E74C9ED1-1527-4B40-AE6C-43043BFAC0AA} => Firefox.exe hxxp://ui.skype.com/ui/0/7.4.0.102/pl/abandoninstall?page=tsProgressBar
Task: {B638EFC5-26C7-4148-A769-F57B06A2D421} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2015-07-08] (Lenovo)
Task: {D99AA887-51DC-4D1B-900B-3591BDC15EC5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Lenovo
DeleteKey: HKLM\SOFTWARE\Wow6432Node\yoursites123Software
S3 FairplayKD; \??\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [X]
C:\Program Files (x86)\Lenovo
C:\Program Files (x86)\Picexa
C:\Program Files (x86)\SFK
C:\ProgramData\BWMiniProB
C:\ProgramData\eWdMe
C:\ProgramData\HWdMH
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\drollbox
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fizzy
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kerbal Space Program
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\osu!\osu! updater.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picexa
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.4
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDirStat
C:\Users\Karol\AppData\Local剜捯獫慴⁲慇敭屳呇⁁屖湥楴汴浥湥⹴湩潦
C:\Users\Karol\AppData\Local\Lenovo
C:\Users\Karol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GameRanger.lnk
C:\Users\Karol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Minecraft
C:\Users\Karol\AppData\Roaming\Mozilla\plugins
C:\Windows\System32\Tasks\Lenovo
C:\Windows\SysWOW64\pl.html
CMD: netsh advfirewall reset
EmptyTemp:

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Z menu Notatnika > Plik > Zapisz jako > wprowadź nazwę fixlist.txt > Kodowanie zmień na UTF-8

 

Plik fixlist.txt umieść obok narzędzia FRST. Uruchom FRST i kliknij w Napraw (Fix). Czekaj cierpliwie, nie przerywaj działania. Gdy Fix ukończy pracę, system zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

 

3. Wyczyść przeglądarki z adware:

 

Firefox:

  • Odłącz synchronizację (o ile włączona): KLIK.
  • Menu Pomoc > Informacje dla pomocy technicznej > Odśwież program Firefox. Zakładki i hasła nie zostaną naruszone.
  • Menu Historia > Wyczyść całą historię przeglądania.
Google Chrome:
  • Zresetuj synchronizację (o ile włączona): KLIK.
  • Ustawienia > karta Rozszerzenia > odinstaluj Shortcuts for All Google™.
  • Ustawienia > karta Ustawienia > Pokaż ustawienia zaawansowane > zjedź na sam spód i uruchom opcję Resetowanie ustawień. Zakładki i hasła nie zostaną naruszone.
4. Zrób nowy log FRST z opcji Skanuj (Scan), ponownie z Addition, ale już bez Shortcut. Dołącz też plik fixlog.txt.
Odnośnik do komentarza
Gość
Ten temat został zamknięty. Brak możliwości dodania odpowiedzi.
Tematy

  • Ostatnio przeglądający   0 użytkowników

    • Brak zarejestrowanych użytkowników przeglądających tę stronę.
×
×
  • Dodaj nową pozycję...