Yousite 123- jak usunąć?

[Ulek91]

Wiem, że pewnie powtarza się już ten wątek, ale na laptopie zainstalował sie yoursite 123 i nie mam pojęcia jak się tego pozbyć :/

 

Addition.txtFRST.txt

[jessica]

1) Odinstaluj ten program:

WinZipper (HKLM-x32\...\WinZipper) (Version: 1.5.134 - Taiwan Shui Mu Chih Ching Technology Limited.) <==== UWAGA

 

2) Użyj >Adw-cleaner
najpierw kliknij na SZUKAJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ (CLEANING), to kliknij na niego.

 

3) Otwórz Notatnik i wklej w nim:

 

Task: {54D799D7-B837-4D24-AB1D-A4AD1DACD17C} - System32\Tasks\{EF11D937-9FD2-47DA-B8A8-642DAF071A55} => pcalua.exe -a C:\Users\Ula\AppData\Roaming\yoursearching\UninstallManager.exe -c  -ptid=cornl
DeleteKey: HKLM\SOFTWARE\Wow6432Node\yoursites123Software
C:\Users\Ula\AppData\Roaming\yoursearching
Task: {765763EA-9728-4380-A866-700990110A7D} - System32\Tasks\{4B608A17-792E-44DF-B55B-615C2110F439} => pcalua.exe -a C:\Users\Ula\AppData\Roaming\istartpageing\UninstallManager.exe -c  -ptid=cor
C:\Users\Ula\AppData\Roaming\istartpageing
ShortcutWithArgument: C:\Users\Ula\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1452235673&z=b0b44454fd8a6430684b635g2z5w9oao4cewbqem0c&from=wpm01073&uid=WDCXWD1600BEVT-22ZCT0_WD-WXD0A79F4234F4234
ShortcutWithArgument: C:\Users\Ula\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1452235673&z=b0b44454fd8a6430684b635g2z5w9oao4cewbqem0c&from=wpm01073&uid=WDCXWD1600BEVT-22ZCT0_WD-WXD0A79F4234F4234
ShortcutWithArgument: C:\Users\Ula\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1452235673&z=b0b44454fd8a6430684b635g2z5w9oao4cewbqem0c&from=wpm01073&uid=WDCXWD1600BEVT-22ZCT0_WD-WXD0A79F4234F4234
ShortcutWithArgument: C:\Users\Ula\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1452235673&z=b0b44454fd8a6430684b635g2z5w9oao4cewbqem0c&from=wpm01073&uid=WDCXWD1600BEVT-22ZCT0_WD-WXD0A79F4234F4234
ShortcutWithArgument: C:\Users\Ula\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1452235673&z=b0b44454fd8a6430684b635g2z5w9oao4cewbqem0c&from=wpm01073&uid=WDCXWD1600BEVT-22ZCT0_WD-WXD0A79F4234F4234
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1452235673&z=b0b44454fd8a6430684b635g2z5w9oao4cewbqem0c&from=wpm01073&uid=WDCXWD1600BEVT-22ZCT0_WD-WXD0A79F4234F4234
HKU\S-1-5-21-4285574080-382458782-4027128846-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://yoursites123.com/web?type=ds&ts=1452235673&z=b0b44454fd8a6430684b635g2z5w9oao4cewbqem0c&from=wpm01073&uid=WDCXWD1600BEVT-22ZCT0_WD-WXD0A79F4234F4234&q={searchTerms}
HKU\S-1-5-21-4285574080-382458782-4027128846-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1452235673&z=b0b44454fd8a6430684b635g2z5w9oao4cewbqem0c&from=wpm01073&uid=WDCXWD1600BEVT-22ZCT0_WD-WXD0A79F4234F4234
HKU\S-1-5-21-4285574080-382458782-4027128846-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1452235673&z=b0b44454fd8a6430684b635g2z5w9oao4cewbqem0c&from=wpm01073&uid=WDCXWD1600BEVT-22ZCT0_WD-WXD0A79F4234F4234
HKU\S-1-5-21-4285574080-382458782-4027128846-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://yoursites123.com/web?type=ds&ts=1452235673&z=b0b44454fd8a6430684b635g2z5w9oao4cewbqem0c&from=wpm01073&uid=WDCXWD1600BEVT-22ZCT0_WD-WXD0A79F4234F4234&q={searchTerms}
R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [711344 2016-01-05] (Taiwan Shui Mu Chih Ching Technology Limited) <==== UWAGA
S2 SkypeUpdate; "C:\Program Files (x86)\Skype\Updater\Updater.exe" [X]
DeleteKey: HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes
DeleteKey: HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes
DeleteKey: HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes
C:\Program Files (x86)\WinZipper
C:\Program Files (x86)\SFK
C:\ProgramData\4WdM4
BHO-x32: Bronze Aid -> {a5bfd1d3-18b6-4fc3-b3f9-262ae3552dbe} -> C:\Program Files (x86)\Bronze Aid\Extensions\a5bfd1d3-18b6-4fc3-b3f9-262ae3552dbe.dll => Brak pliku
C:\Program Files (x86)\Bronze Aid
BHO-x32: Middle Rush -> {d00ab4cc-662c-40b6-a85f-d53086f4bb16} -> C:\Program Files (x86)\Middle Rush\Extensions\d00ab4cc-662c-40b6-a85f-d53086f4bb16.dll => Brak pliku
C:\Program Files (x86)\Middle Rush
FF Extension: Quick Start - C:\Users\Ula\AppData\Roaming\Mozilla\Firefox\Profiles\oxmhc0ds.default\extensions\quick_start@gmail.com [2014-02-26] [brak podpisu cyfrowego]
FF HKLM-x32\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\Ula\AppData\Roaming\Mozilla\Firefox\Profiles\oxmhc0ds.default\extensions\quick_start@gmail.com
R2 SSFK; C:\Program Files (x86)\SFK\SSFK.exe [158400 2016-01-08] (TODO: <公司名>)
R2 WdMan; C:\ProgramData\4WdM4\WdMan.exe [326656 2016-01-08] (TU-Funs LIMITED) [brak podpisu cyfrowego]
S3 cpuz138; \??\C:\Users\Ula\AppData\Local\Temp\cpuz138\cpuz138_x64.sys [X]
S3 SWUMX20; system32\DRIVERS\swumx20.sys [X]
C:\Windows\SysWOW64\pl.html
C:\Users\Ula\AppData\Roaming\WinZipper
C:\Users\Ula\AppData\Roaming\TSv
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper
C:\Users\Ula\AppData\Roaming\sweet-page
C:\Windows\System32\Tasks\{EF11D937-9FD2-47DA-B8A8-642DAF071A55}
C:\Users\Ula\AppData\Roaming\yoursearching
C:\Windows\System32\Tasks\{4B608A17-792E-44DF-B55B-615C2110F439}
C:\Windows\nss60E7.tmp
C:\Users\Ula\AppData\Roaming\GoldenGate
C:\ProgramData\Tmp0x0x
C:\Users\Ula\AppData\Local\Gameo
C:\Users\Ula\AppData\Roaming\istartpageing
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).


----------------------
Jeśli będzie OK, to będziemy kończyć:
Otwórz Notatnik i wklej w nim:

 

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix (NAPRAW).
przez SHIFT+DEL usuń pozostały folder C:\FRST.

W Adw-Cleaner kliknij na przycisk Odinstaluj (UNINSTALL).


Jeśli natomiast problem nie zniknie, to przeinstalujesz przeglądarkę, na której to jeszcze będzie.
.

jessi

[Ulek91]

Wszystko działa, yoursite zniknął. Dzięki bardzo