Skocz do zawartości
WAŻNE - Zakładanie tematu: obowiązkowe logi

Prośba o pomoc - yoursites123

SKVC15

Przez SKVC15
w Dział pomocy doraźnej

Rekomendowane odpowiedzi

Pomoc jest darmowa, ale proszę rozważ przekazanie dotacji na utrzymanie serwisu: klik.
picasso

picasso

Opublikowano
Opublikowano

Zabrakło trzeciego obowiązkowego raportu FRST Shortcut. Operacje do przeprowadzenia:

 

1. Otwórz Notatnik i wklej w nim:

 

CloseProcesses:
CreateRestorePoint:
R1 {55685567-4840-4a91-962b-49a412e9485a}w64; C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}w64.sys [61112 2014-05-26] (StdLib)
R2 IhPul; C:\Users\Sebastian\AppData\Roaming\TSv\TSvr.exe [580752 2015-12-08] (tsvr.com)
ShortcutWithArgument: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.omniboxes.com/?type=sc&ts=1448354052&z=6476c0adde7a03f3dc44b3bgbz3zdb6cfw2zeefz9q&from=ient07031&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3 
ShortcutWithArgument: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449831660&z=5cfd9c999d949ff513bd025g0zdz4tcb2ceg4q3w0z&from=ient07021&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3 
ShortcutWithArgument: C:\Users\Sebastian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449831660&z=5cfd9c999d949ff513bd025g0zdz4tcb2ceg4q3w0z&from=ient07021&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3 
ShortcutWithArgument: C:\Users\Sebastian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449831660&z=5cfd9c999d949ff513bd025g0zdz4tcb2ceg4q3w0z&from=ient07021&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3 
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449831660&z=5cfd9c999d949ff513bd025g0zdz4tcb2ceg4q3w0z&from=ient07021&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3 
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449831660&z=5cfd9c999d949ff513bd025g0zdz4tcb2ceg4q3w0z&from=ient07021&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449831660&z=5cfd9c999d949ff513bd025g0zdz4tcb2ceg4q3w0z&from=ient07021&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1401222184&from=cor&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449831660&z=5cfd9c999d949ff513bd025g0zdz4tcb2ceg4q3w0z&from=ient07021&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449831660&z=5cfd9c999d949ff513bd025g0zdz4tcb2ceg4q3w0z&from=ient07021&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449831660&z=5cfd9c999d949ff513bd025g0zdz4tcb2ceg4q3w0z&from=ient07021&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1401222184&from=cor&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449831660&z=5cfd9c999d949ff513bd025g0zdz4tcb2ceg4q3w0z&from=ient07021&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3&q={searchTerms}
HKU\S-1-5-21-370357082-4189802998-4001306045-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.delta-homes.com/web/?type=ds&ts=1434448814&z=5fbd70c2de5467096b8e3cagczdc4zazfz2b5b2g9z&from=ient06161&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3&q={searchTerms}
HKU\S-1-5-21-370357082-4189802998-4001306045-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449831660&z=5cfd9c999d949ff513bd025g0zdz4tcb2ceg4q3w0z&from=ient07021&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3
HKU\S-1-5-21-370357082-4189802998-4001306045-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449831660&z=5cfd9c999d949ff513bd025g0zdz4tcb2ceg4q3w0z&from=ient07021&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3
HKU\S-1-5-21-370357082-4189802998-4001306045-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1434448814&z=5fbd70c2de5467096b8e3cagczdc4zazfz2b5b2g9z&from=ient06161&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1434448814&z=5fbd70c2de5467096b8e3cagczdc4zazfz2b5b2g9z&from=ient06161&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1434448814&z=5fbd70c2de5467096b8e3cagczdc4zazfz2b5b2g9z&from=ient06161&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3&q={searchTerms}
SearchScopes: HKU\S-1-5-21-370357082-4189802998-4001306045-1001 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449831660&z=5cfd9c999d949ff513bd025g0zdz4tcb2ceg4q3w0z&from=ient07021&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3&q={searchTerms}
SearchScopes: HKU\S-1-5-21-370357082-4189802998-4001306045-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-370357082-4189802998-4001306045-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-370357082-4189802998-4001306045-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449831660&z=5cfd9c999d949ff513bd025g0zdz4tcb2ceg4q3w0z&from=ient07021&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3&q={searchTerms}
SearchScopes: HKU\S-1-5-21-370357082-4189802998-4001306045-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
Toolbar: HKLM - Brak nazwy - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - Brak pliku
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.delta-homes.com/?type=sc&ts=1434448814&z=5fbd70c2de5467096b8e3cagczdc4zazfz2b5b2g9z&from=ient06161&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.yoursites123.com/?type=sc&ts=1449831660&z=5cfd9c999d949ff513bd025g0zdz4tcb2ceg4q3w0z&from=ient07021&uid=ST2000DM001-1CH164_Z1F2SME3XXXXZ1F2SME3
AppInit_DLLs: C:\PROGRA~2\SupTab\SEARCH~2.DLL => Brak pliku
HKLM-x32\...\Run: [updReg] => C:\Windows\UpdReg.EXE
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-370357082-4189802998-4001306045-1001\...\Policies\system: [DisableLockWorkstation] 0
S3 atillk64; \??\C:\Program Files (x86)\AMD\System Monitor\atillk64.sys [X]
DeleteKey: HKCU\Software\1Q1F1S1C1P1E1C1F1N1C1T1H2UtF1E1I
DeleteKey: HKCU\Software\dobreprogramy
DeleteKey: HKCU\Software\InstallCore
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}
DeleteKey: HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
DeleteKey: HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
DeleteKey: HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
DeleteKey: HKLM\SOFTWARE\Mozilla
DeleteKey: HKLM\SOFTWARE\MozillaPlugins
DeleteKey: HKLM\SOFTWARE\Wow6432Node\delta-homesSoftware
DeleteKey: HKLM\SOFTWARE\Wow6432Node\hdcode
DeleteKey: HKLM\SOFTWARE\Wow6432Node\IHProtect
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Mozilla
DeleteKey: HKLM\SOFTWARE\Wow6432Node\MozillaPlugins
DeleteKey: HKLM\SOFTWARE\Wow6432Node\SupDp
DeleteKey: HKLM\SOFTWARE\Wow6432Node\SupTab
DeleteKey: HKLM\SOFTWARE\Wow6432Node\supWPM
DeleteKey: HKLM\SOFTWARE\Wow6432Node\sweet-pageSoftware
DeleteKey: HKLM\SOFTWARE\Wow6432Node\TSv
DeleteKey: HKLM\SOFTWARE\Wow6432Node\yoursites123Software
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{7D3C47ED-E0BE-4940-9DDA-A7A097AEBD88}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
DeleteKey: HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginServices
DeleteKey: HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wpm
DeleteKey: HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WdsManPro
DeleteKey: HKU\S-1-5-18\Software\AskPartnerNetwork
DeleteKey: HKU\S-1-5-18\Software\VNT
Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v AdobeAAMUpdater-1.0 /f
Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v CanonMyPrinter /f
Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v CanonSolutionMenu /f
Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32 /v UpdReg /f
Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID /v {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} /f
RemoveDirectory: C:\AdwCleaner
RemoveDirectory: C:\Program Files (x86)\MiuiTab
RemoveDirectory: C:\Program Files (x86)\SFK
RemoveDirectory: C:\Program Files (x86)\SupTab
RemoveDirectory: C:\ProgramData\apn
RemoveDirectory: C:\ProgramData\IePluginServices
RemoveDirectory: C:\ProgramData\IHProtectUpDate
RemoveDirectory: C:\ProgramData\WPM
RemoveDirectory: C:\Users\Sebastian\AppData\Local\bcfd
RemoveDirectory: C:\Users\Sebastian\AppData\Roaming\sweet-page
RemoveDirectory: C:\Users\Sebastian\AppData\Roaming\TSv
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
C:\Users\Sebastian\AppData\Local\70149b02515b3bb20dd492.47983420
C:\Users\Sebastian\AppData\Local\user_data.ini
C:\Users\Sebastian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Picexa.lnk
C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}w64.sys
C:\Windows\SysWOW64\pl.html
C:\Windows\SysWOW64\pl5.exe
EmptyTemp:

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Napraw (Fix). Czekaj cierpliwie, nie przerywaj działania. Gdy Fix ukończy pracę, system zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

 

2. W Google Chrome:

  • Zresetuj synchronizację (o ile włączona): KLIK.
  • Ustawienia > karta Ustawienia > Pokaż ustawienia zaawansowane > zjedź na sam spód i uruchom opcję Resetowanie ustawień. Zakładki i hasła nie zostaną naruszone, ale używane rozszerzenia zostaną wyłączone (włącz ponownie ręcznie).
  • Zresetuj cache wtyczek. W pasku adresów wpisz chrome://plugins i ENTER. Na liście wtyczek wybierz dowolną i kliknij Wyłącz. Następnie wtyczkę ponownie Włącz.
3. Zrób nowy log FRST z opcji Skanuj (Scan), z Addition i Shortcut. Dołącz też plik fixlog.txt.
picasso

picasso

Opublikowano
Opublikowano

Wszystko wykonane. Teraz pobierz najnowszy AdwCleaner. Uruchom, wybierz opcję Skanuj i dostarcz log wynikowy z folderu C:\AdwCleaner. On był wcześniej używany, ale ślady w logu wskazywały, że albo stara wersja, albo nic w nim nie zrobiono, bo niektóre foldery powinny być przez niego usunięte już wcześniej.

Gość
Ten temat został zamknięty. Brak możliwości dodania odpowiedzi.
Tematy

  • Ostatnio przeglądający   0 użytkowników

    • Brak zarejestrowanych użytkowników przeglądających tę stronę.
×
×
  • Dodaj nową pozycję...