Pomoc w usunięciu yoursites123

[zielny]

Też mam ten problem , czy mogę liczyć na pomoc ?

Shortcut.txt

Addition.txt

FRST.txt

[picasso]

Zasady działu: KLIK. Tu jest zakaz podpienia się się. Temat wydzielony w osobny.

 

Operacje do przeprowadzenia:

 

1. Otwórz Notatnik i wklej w nim:

 

CloseProcesses:
CreateRestorePoint:
R2 ihpmServer; C:\Program Files\RayDld\ihpmServer.exe [271592 2015-11-19] (Ray you)
R2 IhPul; C:\Users\Eko Helios PDK\AppData\Roaming\TSv\TSvr.exe [580752 2015-12-08] (tsvr.com)
R2 SSFK; C:\Program Files\SFK\SSFK.exe [170144 2015-11-27] (TODO: )
R2 WdMan; C:\ProgramData\HWdMH\WdMan.exe [333312 2015-12-04] (TFuns LIMITED) [brak podpisu cyfrowego]
S3 AvastVBoxSvc; "C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe" [X]
S2 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [X]
S1 wfdrvr_vt_1_10_0_28; system32\drivers\wfdrvr_vt_1_10_0_28.sys [X]
ShortcutWithArgument: C:\Users\Eko Helios PDK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449647768&z=a2a6a5e93aec34696fa5b80g7zez8t7q8z8m7m7q6t&from=ient07021&uid=TOSHIBAXMK2546GSX_28OMC0QITXX28OMC0QIT 
ShortcutWithArgument: C:\Users\Eko Helios PDK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449647768&z=a2a6a5e93aec34696fa5b80g7zez8t7q8z8m7m7q6t&from=ient07021&uid=TOSHIBAXMK2546GSX_28OMC0QITXX28OMC0QIT 
ShortcutWithArgument: C:\Users\Eko Helios PDK\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449647768&z=a2a6a5e93aec34696fa5b80g7zez8t7q8z8m7m7q6t&from=ient07021&uid=TOSHIBAXMK2546GSX_28OMC0QITXX28OMC0QIT 
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449647768&z=a2a6a5e93aec34696fa5b80g7zez8t7q8z8m7m7q6t&from=ient07021&uid=TOSHIBAXMK2546GSX_28OMC0QITXX28OMC0QIT
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartpageing.com/web/?type=ds&ts=1448291730&z=e38733ac16a192110914105g2z4z3b3o3t9g2m8cbe&from=cornl&uid=toshibaxmk2546gsx_28omc0qitxx28omc0qit&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449647768&z=a2a6a5e93aec34696fa5b80g7zez8t7q8z8m7m7q6t&from=ient07021&uid=TOSHIBAXMK2546GSX_28OMC0QITXX28OMC0QIT
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartpageing.com/web/?type=ds&ts=1448291730&z=e38733ac16a192110914105g2z4z3b3o3t9g2m8cbe&from=cornl&uid=toshibaxmk2546gsx_28omc0qitxx28omc0qit&q={searchTerms}
HKU\S-1-5-21-3618850881-1739361237-2590381527-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449647768&z=a2a6a5e93aec34696fa5b80g7zez8t7q8z8m7m7q6t&from=ient07021&uid=TOSHIBAXMK2546GSX_28OMC0QITXX28OMC0QIT&q={searchTerms}
HKU\S-1-5-21-3618850881-1739361237-2590381527-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.pl/
HKU\S-1-5-21-3618850881-1739361237-2590381527-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449647768&z=a2a6a5e93aec34696fa5b80g7zez8t7q8z8m7m7q6t&from=ient07021&uid=TOSHIBAXMK2546GSX_28OMC0QITXX28OMC0QIT
HKU\S-1-5-21-3618850881-1739361237-2590381527-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449647768&z=a2a6a5e93aec34696fa5b80g7zez8t7q8z8m7m7q6t&from=ient07021&uid=TOSHIBAXMK2546GSX_28OMC0QITXX28OMC0QIT&q={searchTerms}
SearchScopes: HKLM -> DefaultScope - brak wartości
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1448290114&z=a74c789253ec07611735527g1z2z0b3ofb7t9m4tab&from=cor&uid=TOSHIBAXMK2546GSX_28OMC0QITXX28OMC0QIT
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => Brak pliku
Task: {01D1A698-1985-4E48-AE43-588DBA18E966} - System32\Tasks\Opera N Saturday => C:\Program Files\Opera\launcher.exe
Task: {01E9A868-B37A-46C0-8AF1-9D8A36263667} - System32\Tasks\{812A6AC1-8156-4A46-BEE2-46B9FABB3AB5} => pcalua.exe -a E:\Setup.exe -d E:\
Task: {183BB776-2F68-49F3-9DAE-020A792C03CF} - System32\Tasks\Opera N Sunday => C:\Program Files\Opera\launcher.exe
Task: {E39CE3A4-1683-4624-A082-8BD5FCEA5414} - System32\Tasks\{3B524084-A09A-4299-9467-D82A213B0C93} => pcalua.exe -a "C:\Users\Eko Helios PDK\AppData\Roaming\istartsurf\UninstallManager.exe" -c -ptid=cor
DeleteKey: HKLM\SOFTWARE\MozillaPlugins
DeleteKey: HKLM\SOFTWARE\yoursites123Software
C:\Program Files\Google
C:\Program Files\Mozilla Maintenance Service
C:\Program Files\Opera
C:\Program Files\RayDld
C:\Program Files\SFK
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
C:\ProgramData\AVAST Software
C:\ProgramData\HWdMH
C:\ProgramData\SWMiniProS
C:\ProgramData\rWdMr
C:\ProgramData\XWMiniProX
C:\Users\Eko Helios PDK\AppData\Local\Adobe
C:\Users\Eko Helios PDK\AppData\Local\Google
C:\Users\Eko Helios PDK\AppData\Local\Opera Software
C:\Users\Eko Helios PDK\AppData\Local\Thunderbird
C:\Users\Eko Helios PDK\AppData\Roaming\istartsurf
C:\Users\Eko Helios PDK\AppData\Roaming\Mozilla
C:\Users\Eko Helios PDK\AppData\Roaming\Opera Software
C:\Users\Eko Helios PDK\AppData\Roaming\Shortcut
C:\Users\Eko Helios PDK\AppData\Roaming\sweet-page
C:\Users\Eko Helios PDK\AppData\Roaming\Thunderbird
C:\Users\Eko Helios PDK\AppData\Roaming\TSv
C:\Windows\system32\pl.html
Folder: C:\Device
CMD: netsh advfirewall reset
EmptyTemp:

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Napraw (Fix). Czekaj cierpliwie, nie przerywaj działania. Gdy Fix ukończy pracę, system zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

 

2. Zrób nowy log FRST z opcji Skanuj (Scan), ponownie z Addition, ale bez Shortcut. Dołącz też plik fixlog.txt.

Edytowane 2 Czerwca 2016 przez picasso
Temat zostaje zamknięty z powodu braku odpowiedzi. //picasso