yoursites123 - problem z wirusem w przeglądarce

[kamz]

Witam serdecznie.

 

Od jakiegoś czasu mam problem ze stroną yoursites123, która automatycznie otwiera mi się przy każdorazowym uruchamianiu przeglądarki internetowej. Używam programu antywirusowego Norton Security, skanowanie systemu nie pomogło. Wchodziłem też w ustawienia przeglądarki, zrobiłem zmiany w stronie startowej - z marnym skutkiem. Prosiłbym o pomoc w zlikwidowaniu tego problemu. Dołączam wyniki skanowania przez FRST64. 

 

Z góry bardzo dziękuję.

 

Pozdrawiam.

FRST.txt

Addition.txt

Shortcut.txt

[jessica]

1) Odinstaluj ten program:

WinZipper (HKLM-x32\...\WinZipper) (Version: 1.5.130 - Taiwan Shui Mu Chih Ching Technology Limited.) <==== UWAGA

 

2) Otwórz Notatnik i wklej w nim:

 

DeleteKey: HKLM\SOFTWARE\Wow6432Node\yoursites123Software
ShortcutWithArgument: C:\Users\cicilia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449657586&z=76c14a860f57e0c33eb912eg9z1z9tfq5w6mcw6b3w&from=ient07021&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001
ShortcutWithArgument: C:\Users\cicilia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449657586&z=76c14a860f57e0c33eb912eg9z1z9tfq5w6mcw6b3w&from=ient07021&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001
ShortcutWithArgument: C:\Users\cicilia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449657586&z=76c14a860f57e0c33eb912eg9z1z9tfq5w6mcw6b3w&from=ient07021&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001
ShortcutWithArgument: C:\Users\cicilia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449657586&z=76c14a860f57e0c33eb912eg9z1z9tfq5w6mcw6b3w&from=ient07021&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001
ShortcutWithArgument: C:\Users\cicilia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WarThunder.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449657586&z=76c14a860f57e0c33eb912eg9z1z9tfq5w6mcw6b3w&from=ient07021&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001
ShortcutWithArgument: C:\Users\cicilia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449657586&z=76c14a860f57e0c33eb912eg9z1z9tfq5w6mcw6b3w&from=ient07021&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449657586&z=76c14a860f57e0c33eb912eg9z1z9tfq5w6mcw6b3w&from=ient07021&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449657586&z=76c14a860f57e0c33eb912eg9z1z9tfq5w6mcw6b3w&from=ient07021&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001
C:\Program Files (x86)\WinZipper
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1450776804&z=d0bba9a8275e377ab3f8c2ag4zfwcebmem3qfb6e9o&from=wpm07173&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1450776804&z=d0bba9a8275e377ab3f8c2ag4zfwcebmem3qfb6e9o&from=wpm07173&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartpageing.com/web/?type=ds&ts=1448364722&z=6182b763b6d3aa10aa6baf2g9zcz5bec4q1zem4o3o&from=cornl&uid=st1000lm024xhn-m101mbb_s32xj9afc02001&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartpageing.com/web/?type=ds&ts=1448364722&z=6182b763b6d3aa10aa6baf2g9zcz5bec4q1zem4o3o&from=cornl&uid=st1000lm024xhn-m101mbb_s32xj9afc02001&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1450776804&z=d0bba9a8275e377ab3f8c2ag4zfwcebmem3qfb6e9o&from=wpm07173&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1450776804&z=d0bba9a8275e377ab3f8c2ag4zfwcebmem3qfb6e9o&from=wpm07173&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartpageing.com/web/?type=ds&ts=1448364722&z=6182b763b6d3aa10aa6baf2g9zcz5bec4q1zem4o3o&from=cornl&uid=st1000lm024xhn-m101mbb_s32xj9afc02001&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartpageing.com/web/?type=ds&ts=1448364722&z=6182b763b6d3aa10aa6baf2g9zcz5bec4q1zem4o3o&from=cornl&uid=st1000lm024xhn-m101mbb_s32xj9afc02001&q={searchTerms}
HKU\S-1-5-21-217704860-3642134-2051443247-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449657586&z=76c14a860f57e0c33eb912eg9z1z9tfq5w6mcw6b3w&from=ient07021&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001&q={searchTerms}
HKU\S-1-5-21-217704860-3642134-2051443247-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1450776804&z=d0bba9a8275e377ab3f8c2ag4zfwcebmem3qfb6e9o&from=wpm07173&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001
HKU\S-1-5-21-217704860-3642134-2051443247-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1450776804&z=d0bba9a8275e377ab3f8c2ag4zfwcebmem3qfb6e9o&from=wpm07173&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001
HKU\S-1-5-21-217704860-3642134-2051443247-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449657586&z=76c14a860f57e0c33eb912eg9z1z9tfq5w6mcw6b3w&from=ient07021&uid=ST1000LM024XHN-M101MBB_S32XJ9AFC02001&q={searchTerms}
SearchScopes: HKLM -> DefaultScope - brak wartości
SearchScopes: HKLM-x32 -> DefaultScope - brak wartości
R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [711344 2015-12-14] (Taiwan Shui Mu Chih Ching Technology Limited) <==== UWAGA
S2 McAfee SiteAdvisor Service; "c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe" [X]
2015-12-22 10:34 - 2016-01-14 17:29 - 00000000 ____D C:\Program Files (x86)\WinZipper
2015-12-22 10:34 - 2015-12-22 10:34 - 00000000 ____D C:\Users\cicilia\AppData\Roaming\WinZipper
2015-12-22 10:34 - 2015-12-22 10:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper
2015-12-22 10:33 - 2015-12-28 23:30 - 00000000 ____D C:\ProgramData\7WdM7
2015-12-22 10:33 - 2015-12-27 15:14 - 00000000 ____D C:\ProgramData\ZWdMZ
C:\Program Files (x86)\RayDld
:\ProgramData\XWdMX
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

Daj ten log.

 

3) Zrób nowe logi FRST.

 

jessi