Problem z yoursite

[eMa]

Witam, mam problem ze strona yoursite123 której nie mogę usunąć. Proszę o pomoc. Logi w załączniku

 

 

 

 

 

 

 

 

FRST.txt

Addition.txt

Shortcut.txt

[jessica]

Otwórz Notatnik i wklej w nim:

 

DeleteKey: HKLM\SOFTWARE\Wow6432Node\yoursites123Software
ShortcutWithArgument: C:\Users\Martyna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1452245337&z=3b9ef33f1eaa2af68c90265gdzcwfofo0z6wccezbg&from=wpm01073&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733
ShortcutWithArgument: C:\Users\Martyna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1452245337&z=3b9ef33f1eaa2af68c90265gdzcwfofo0z6wccezbg&from=wpm01073&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733
ShortcutWithArgument: C:\Users\Martyna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1452245337&z=3b9ef33f1eaa2af68c90265gdzcwfofo0z6wccezbg&from=wpm01073&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733
ShortcutWithArgument: C:\Users\Martyna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1452245337&z=3b9ef33f1eaa2af68c90265gdzcwfofo0z6wccezbg&from=wpm01073&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733
ShortcutWithArgument: C:\Users\Martyna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1452245337&z=3b9ef33f1eaa2af68c90265gdzcwfofo0z6wccezbg&from=wpm01073&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1452245337&z=3b9ef33f1eaa2af68c90265gdzcwfofo0z6wccezbg&from=wpm01073&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1452245337&z=3b9ef33f1eaa2af68c90265gdzcwfofo0z6wccezbg&from=wpm01073&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://yoursites123.com/web?type=ds&ts=1452245337&z=3b9ef33f1eaa2af68c90265gdzcwfofo0z6wccezbg&from=wpm01073&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1452245337&z=3b9ef33f1eaa2af68c90265gdzcwfofo0z6wccezbg&from=wpm01073&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://yoursites123.com/web?type=ds&ts=1452245337&z=3b9ef33f1eaa2af68c90265gdzcwfofo0z6wccezbg&from=wpm01073&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://yoursites123.com/web?type=ds&ts=1452245337&z=3b9ef33f1eaa2af68c90265gdzcwfofo0z6wccezbg&from=wpm01073&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://yoursites123.com/web?type=ds&ts=1452245337&z=3b9ef33f1eaa2af68c90265gdzcwfofo0z6wccezbg&from=wpm01073&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733&q={searchTerms}
SearchScopes: HKU\S-1-5-21-946734987-201425966-3322790820-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://yoursites123.com/web?type=ds&ts=1452245337&z=3b9ef33f1eaa2af68c90265gdzcwfofo0z6wccezbg&from=wpm01073&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733&q={searchTerms}
SearchScopes: HKU\S-1-5-21-946734987-201425966-3322790820-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://yoursites123.com/web?type=ds&ts=1452245337&z=3b9ef33f1eaa2af68c90265gdzcwfofo0z6wccezbg&from=wpm01073&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartpageing.com/?type=sc&ts=1449430358&z=b2ca7111c58e0c611999319g9zbzatez2c8e6c2wct&from=cor&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733
FF HKLM\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\Martyna\AppData\Roaming\Mozilla\Firefox\Profiles\jcbi7h2k.default\extensions\deskCutv2@gmail.com => not found
FF HKLM\...\Firefox\Extensions: [yahooprotected@gmail.com] - C:\Users\Martyna\AppData\Roaming\Mozilla\Firefox\Profiles\jcbi7h2k.default\extensions\yahooprotected@gmail.com => not found
FF HKLM\...\Firefox\Extensions: [default_newtabff@gmail.com] - C:\Users\Martyna\AppData\Roaming\Mozilla\Firefox\Profiles\jcbi7h2k.default\extensions\default_newtabff@gmail.com => not found
StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla Firefox\firefox.exe hxxp://www.yoursites123.com/?type=sc&ts=1452245337&z=3b9ef33f1eaa2af68c90265gdzcwfofo0z6wccezbg&from=wpm01073&uid=WDCXWD3200BEVT-80A0RT0_WD-WXK1A50P6733P6733
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S1 wfdrvr_vt_1_10_0_28; system32\drivers\wfdrvr_vt_1_10_0_28.sys [X]
2016-01-08 19:19 - 2016-01-09 18:03 - 00000001 _____ C:\Windows\system32\pl.html
2016-01-08 10:30 - 2016-01-10 12:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper
2016-01-08 10:30 - 2016-01-09 18:39 - 00000000 ____D C:\Program Files\WinZipper
2016-01-08 10:30 - 2016-01-09 18:11 - 00000000 ____D C:\Program Files\SFK
2016-01-08 10:30 - 2016-01-08 10:30 - 00000000 ____D C:\Users\Martyna\AppData\Roaming\WinZipper
2016-01-08 10:29 - 2016-01-09 18:11 - 00000000 ____D C:\Users\Martyna\AppData\Roaming\TSv
2016-01-08 10:28 - 2016-01-09 18:11 - 00000000 ____D C:\ProgramData\cWdMc
2016-01-08 10:28 - 2016-01-08 10:28 - 00000074 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-12-14 15:09 - 2015-12-17 17:44 - 00002377 _____ C:\Windows\system32\findit.xml
2015-12-06 20:33 - 2015-12-06 20:36 - 00000000 ____D C:\Users\Martyna\AppData\Roaming\istartpageing
2015-12-06 20:33 - 2015-12-06 20:33 - 00000000 ____D C:\ProgramData\Tmp0x0x
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).


----------------------
Jeśli będzie OK, to będziemy kończyć:
Otwórz Notatnik i wklej w nim:

 

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix (NAPRAW).
przez SHIFT+DEL usuń pozostały folder C:\FRST.


Jeśli natomiast problem nie zniknie, to przeinstalujesz przeglądarkę, na której to jeszcze będzie.
.

jessi

[eMa]

Pomogło, dziękuje bardzo