Elektroda.pl
Elektroda.pl
X
Please add exception to AdBlock for elektroda.pl.
If you watch the ads, you support portal and users.

Jak usunąć wirusa yoursites123 ?

jf14 13 Dec 2015 06:05 1131 3
  • #2
    krzychupar
    Level 43  
    Otwórz notatnik systemowy i wklej:

    ShortcutWithArgument: C:\Users\Użytkownik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969 <==== UWAGA
    ShortcutWithArgument: C:\Users\Użytkownik\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969 <==== UWAGA
    ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969 <==== UWAGA
    ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969 <==== UWAGA
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969
    HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
    SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
    SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
    SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
    SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
    StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.yoursites123.com/?type=sc&ts=1449656769&z=22e29ed08820b4cce317107g5z5zct8q4w4q0m1m0e&from=ient07021&uid=SAMSUNGXSSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969
    S3 PrintNotify; C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll [X]
    2015-12-12 12:40 - 2015-12-12 12:40 - 00000001 _____ C:\Windows\SysWOW64\pl.html
    2015-12-09 11:26 - 2015-12-09 11:27 - 00000000 ____D C:\ProgramData\ZWdMZ
    2015-12-09 11:25 - 2015-12-09 11:25 - 00000000 ____D C:\ProgramData\UWdMU
    C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
    C:\Users\Public\GROUP.dat
    2015-10-26 23:23 - 2015-10-26 23:23 - 0000057 _____ () C:\ProgramData\Ament.ini
    2015-11-03 11:25 - 2015-11-03 18:10 - 0004111 _____ () C:\ProgramData\hpzinstall.log
    2015-11-25 21:34 - 2015-11-25 21:34 - 0004912 _____ () C:\ProgramData\lbogtyso.zat
    2015-11-25 21:34 - 2015-11-25 21:34 - 0000016 _____ () C:\ProgramData\mntemp
    EmptyTemp:

    Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.
    Uruchom FRST i kliknij w Fix/Napraw.
  • #3
    Kolobos
    IT specialist
    @jf14 do fixlist.txt dodaj jeszcze:
    Task: {076B7068-802E-4411-A2AB-04837C6054B8} - System32\Tasks\{68E393EB-2F96-4510-A58F-C68918B08BD9} => pcalua.exe -a C:\Users\Użytkownik\AppData\Roaming\istartsurf\UninstallManager.exe -c -ptid=cor
    AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:9695
    AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:9733
    AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:9831
    (TFuns LIMITED) C:\ProgramData\ZWdMZ\WdMan.exe
    R2 WdMan; C:\ProgramData\ZWdMZ\WdMan.exe [333312 2015-12-04] (TFuns LIMITED) [Brak podpisu cyfrowego]


    @krzychupar nadal pomijasz za kazdym razem:
    (TFuns LIMITED) C:\ProgramData\ZWdMZ\WdMan.exe
    R2 WdMan; C:\ProgramData\ZWdMZ\WdMan.exe [333312 2015-12-04] (TFuns LIMITED) [Brak podpisu cyfrowego]

    Czy mozesz zwracac na to uwage?