Skocz do zawartości
WAŻNE - Użytkownicy uprawnieni do pomocy
WAŻNE - Zakładanie tematu: obowiązkowe logi
Nadchodzące zmiany w logowaniu

Jeszcze jeden i jeszcze raz: yoursites123

zeus85

Przez zeus85
w Dział pomocy doraźnej

Rekomendowane odpowiedzi

Pomoc jest darmowa, ale proszę rozważ przekazanie dotacji na utrzymanie serwisu: klik.
picasso

picasso

Opublikowano
Opublikowano

Operacje do przeprowadzenia:

 

1. Uruchom narzędzie Microsoftu: KLIK. Zaakceptuj > Wykryj problemy i pozwól mi wybrać poprawki do zastosowania > Odinstalowywanie > zaznacz na liście wpis Metric Collection SDK > Dalej.

 

2. Otwórz Notatnik i wklej w nim:

 

CloseProcesses:
CreateRestorePoint:
CMD: md C:\Users\Mal\Desktop\Upload
CMD: xcopy /e C:\Users\Mal\AppData\Roaming\Mozilla C:\Users\Mal\Desktop\Upload
Reg: reg export HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions C:\Users\Mal\Desktop\Upload\ff.reg
R2 ihpmServer; C:\Program Files (x86)\RayDld\ihpmServer.exe [271592 2015-11-03] ()
R2 IhPul; C:\Users\Mal\AppData\Roaming\TSv\TSvr.exe [580752 2015-12-08] (tsvr.com)
R2 SSFK; C:\Program Files (x86)\SFK\SSFK.exe [170144 2015-11-27] (TODO: )
R2 WdMan; C:\ProgramData\1WdM1\WdMan.exe [333312 2015-12-04] (TFuns LIMITED) [brak podpisu cyfrowego]
S1 wfdrvr_vw_1_10_0_28; system32\drivers\wfdrvr_vw_1_10_0_28.sys [X]
GroupPolicy: Ograniczenia - Chrome 
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia 
ShortcutWithArgument: C:\Users\Mal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2 
ShortcutWithArgument: C:\Users\Mal\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2 
ShortcutWithArgument: C:\Users\Mal\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2 
ShortcutWithArgument: C:\Users\Mal\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2 
ShortcutWithArgument: C:\Users\Mal\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2 
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2 
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2 
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2 
ShortcutWithArgument: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2 
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.yoursites123.com/?type=sc&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.yoursites123.com/?type=sc&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1446573454&z=dc1feb6eef922286c234a5cgcz0zbq0w7m4cdgdb3o&from=cor&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1446665398&z=a010232c5d9a3b17a9f75cdg9zdzcq7qcq3w0c3t7b&from=cornl&uid=st9500420as_5vjeryn2xxxx5vjeryn2&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1446665398&z=a010232c5d9a3b17a9f75cdg9zdzcq7qcq3w0c3t7b&from=cornl&uid=st9500420as_5vjeryn2xxxx5vjeryn2&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1446665398&z=a010232c5d9a3b17a9f75cdg9zdzcq7qcq3w0c3t7b&from=cornl&uid=st9500420as_5vjeryn2xxxx5vjeryn2&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1446665398&z=a010232c5d9a3b17a9f75cdg9zdzcq7qcq3w0c3t7b&from=cornl&uid=st9500420as_5vjeryn2xxxx5vjeryn2&q={searchTerms}
HKU\S-1-5-21-3949296395-2619626920-865811533-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2&q={searchTerms}
HKU\S-1-5-21-3949296395-2619626920-865811533-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2
HKU\S-1-5-21-3949296395-2619626920-865811533-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2
HKU\S-1-5-21-3949296395-2619626920-865811533-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2&q={searchTerms}
SearchScopes: HKLM -> DefaultScope - brak wartości
SearchScopes: HKLM-x32 -> DefaultScope - brak wartości
SearchScopes: HKU\S-1-5-21-3949296395-2619626920-865811533-1001 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3949296395-2619626920-865811533-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2&q={searchTerms}
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\Mal\AppData\Roaming\Mozilla\Firefox\Profiles\nvhhgxkk.default\extensions\deskCutv2@gmail.com => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [sidebarff@gmail.com] - C:\Users\Mal\AppData\Roaming\Mozilla\Firefox\Profiles\nvhhgxkk.default\extensions\sidebarff@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [default_newtabff@gmail.com] - C:\Users\Mal\AppData\Roaming\Mozilla\Firefox\Profiles\nvhhgxkk.default\extensions\default_newtabff@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [yahooprotected@gmail.com] - C:\Users\Mal\AppData\Roaming\Mozilla\Firefox\Profiles\nvhhgxkk.default\extensions\yahooprotected@gmail.com
CHR DefaultSearchURL: Default -> hxxp://www.yoursites123.com/web/?type=ds&ts=1449741591&z=2850e4d36d086964c37b6d5g5z2z9t8m5z3gdw4t8g&from=ient07021&uid=ST9500420AS_5VJERYN2XXXX5VJERYN2&q={searchTerms}
CHR HKLM\...\Chrome\Extension: [jdiejbegdjikmehflknhkbieocmnogcf] - C:\Users\Mal\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdiejbegdjikmehflknhkbieocmnogcf.crx [2015-11-07]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-11-01]
CHR HKLM-x32\...\Chrome\Extension: [jdiejbegdjikmehflknhkbieocmnogcf] - C:\Users\Mal\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdiejbegdjikmehflknhkbieocmnogcf.crx [2015-11-07]
Task: {13223C2E-5392-4037-ABDA-EF8C9DA40A68} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2015-07-08] (Lenovo)
HKU\S-1-5-21-3949296395-2619626920-865811533-1001\...\Policies\system: [DisableLockWorkstation] 0
DeleteKey: HKCU\Software\1Q1F1S1C1P1E1C1F1N1C1T1H2UtF1E1I
DeleteKey: HKCU\Software\dobreprogramy
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Lenovo
DeleteKey: HKLM\SOFTWARE\Wow6432Node\yoursites123Software
RemoveDirectory: C:\Program Files (x86)\Lenovo
RemoveDirectory: C:\Program Files (x86)\RayDld
RemoveDirectory: C:\Program Files (x86)\SFK
RemoveDirectory: C:\ProgramData\1WdM1
RemoveDirectory: C:\ProgramData\pWMiniProp
RemoveDirectory: C:\ProgramData\vWdMv
RemoveDirectory: C:\Users\Mal\AppData\Local\Lenovo
RemoveDirectory: C:\Users\Mal\AppData\Roaming\TSv
RemoveDirectory: C:\Windows\System32\Tasks\Lenovo
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
C:\Users\Mal\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Picexa.lnk
C:\Windows\SysWOW64\pl.html
EmptyTemp:

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Napraw (Fix). Czekaj cierpliwie, nie przerywaj działania. Gdy Fix ukończy pracę, system zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

 

3. Wyczyść przeglądarki z adware:

 

Firefox:

  • Odłącz synchronizację (o ile włączona): KLIK.
  • Menu Pomoc > Informacje dla pomocy technicznej > Odśwież program Firefox. Zakładki i hasła nie zostaną naruszone, ale Adblock Plus trzeba będzie przeinstalować.
  • Menu Historia > Wyczyść całą historię przeglądania.
Google Chrome:
  • Zresetuj synchronizację (o ile włączona): KLIK.
  • Ustawienia > karta Ustawienia > Pokaż ustawienia zaawansowane > zjedź na sam spód i uruchom opcję Resetowanie ustawień. Zakładki i hasła nie zostaną naruszone.
4. Zrób nowy log FRST z opcji Skanuj (Scan), ponownie z Addition, ale już bez Shortcut. Dołącz też plik fixlog.txt.

 

Poza tym, na Pulpicie powstał folder Upload - proszę spakuj go do ZIP, shostuj gdzieś i podaj do niego link.

Odnośnik do komentarza
picasso

picasso

Opublikowano
Opublikowano

Drobna poprawka. Otwórz Notatnik i wklej w nim:

 

DeleteKey: HKCU\Software\distromatic
DeleteKey: HKCU\Software\PRODUCTSETUP
DeleteKey: HKCU\Software\Mozilla\Extends
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Classes\AppID\{85198F55-85AC-498A-BFE4-BBC33840F4AB}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\FFPluginHp
DeleteKey: HKLM\SOFTWARE\Wow6432Node\hdcode
DeleteKey: HKLM\SOFTWARE\Wow6432Node\istartsurfSoftware
DeleteKey: HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware
DeleteKey: HKLM\SOFTWARE\Wow6432Node\RayDld
DeleteKey: HKLM\SOFTWARE\Wow6432Node\ihpmserver
DeleteKey: HKLM\SOFTWARE\Wow6432Node\TSv
DeleteKey: HKLM\SOFTWARE\Wow6432Node\WdsManPro
DeleteKey: HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WdsManPro
RemoveDirectory: C:\FRST\Quarantine
RemoveDirectory: C:\MATS
RemoveDirectory: C:\Users\Mal\AppData\Roaming\istartsurf
RemoveDirectory: C:\Users\Mal\Desktop\Stare dane programu Firefox
RemoveDirectory: C:\Users\Mal\Desktop\Upload
CMD: del /q C:\Users\Mal\Downloads\MicrosoftFixit.ProgramInstallUninstall.RNP.Run.exe

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Napraw (Fix). Tym razem nie będzie restartu. Przedstaw wynikowy fixlog.txt.

Odnośnik do komentarza
zeus85

zeus85

Opublikowano
  • Autor
Opublikowano

# DelFix v1.011 - Logfile created 12/12/2015 at 19:06:17

# Updated 18/08/2015 by Xplode

# Username : Mal - MALKOMP

# Operating System : Windows 8.1 Pro  (64 bits)

 

 

~ Removing disinfection tools ...

 

 

Deleted : C:\FRST

Deleted : C:\AdwCleaner

Deleted : C:\Users\Mal\Downloads\FRST-OlderVersion

Deleted : C:\Users\Mal\Downloads\AdwCleaner.exe

Deleted : C:\Users\Mal\Downloads\Fixlog.txt

Deleted : C:\Users\Mal\Downloads\FRST64.exe

Deleted : HKLM\SOFTWARE\AdwCleaner

 

 

########## - EOF - ##########

Odnośnik do komentarza
Gość
Ten temat został zamknięty. Brak możliwości dodania odpowiedzi.
Tematy

  • Ostatnio przeglądający   0 użytkowników

    • Brak zarejestrowanych użytkowników przeglądających tę stronę.
×
×
  • Dodaj nową pozycję...