Strony yoursites123 oraz omniboxes ładują sie samowolnie

[Mikou@j]

Witam, mam problem ze stroną yoursites123 oraz omniboxes ładującą sie samowolnie na przeglądarce opera mini oraz na mozilla firefox.

[ordynat]

1) Odinstaluj

PriceFountain (HKU\S-1-5-21-2869952153-1275128176-2488552377-1001\...\PriceFountain) (Version: - ) <==== UWAGA
Update for PriceFountain (HKU\S-1-5-21-2869952153-1275128176-2488552377-1001\...\Price Fountain) (Version: - Update for PriceFountain) <==== UWAGA

2) Otwórz Notatnik i wklej w nim:

Task: {8EAF6ED6-C049-446C-961E-6C3E2F81D3E4} - System32\Tasks\WerkaRumaniaUpholsterV2 => Rundll32.exe MandateCongruences.dll,main 7 1 <==== UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1438895827&z=b1b6afba2912eacb161a2b2gfz2c0b2b9tcw5m3q3e&from=cornl&uid=WDCXWD10JPCX-24UE4T0_WD-WXD1E84EVL7CEVL7C&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1451915379&z=45bcd9e398064b0a1f9f6f7g9zfw6gdt6gcw6cdmeb&from=wpm12253&uid=WDCXWD10JPCX-24UE4T0_WD-WXD1E84EVL7CEVL7C
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1438895827&z=b1b6afba2912eacb161a2b2gfz2c0b2b9tcw5m3q3e&from=cornl&uid=WDCXWD10JPCX-24UE4T0_WD-WXD1E84EVL7CEVL7C&q={searchTerms}
HKU\S-1-5-21-2869952153-1275128176-2488552377-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.omniboxes.com/web/?type=ds&ts=1448631996&z=03deca22d4081fcaf2c9450g7zfz1bbq4c6g4t0t7b&from=ient07021&uid=WDCXWD10JPCX-24UE4T0_WD-WXD1E84EVL7CEVL7C&q={searchTerms}
HKU\S-1-5-21-2869952153-1275128176-2488552377-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131023650896434634&GUID=2CF60601-C365-407C-9236-EDA611FF8109
HKU\S-1-5-21-2869952153-1275128176-2488552377-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1451915379&z=45bcd9e398064b0a1f9f6f7g9zfw6gdt6gcw6cdmeb&from=wpm12253&uid=WDCXWD10JPCX-24UE4T0_WD-WXD1E84EVL7CEVL7C
HKU\S-1-5-21-2869952153-1275128176-2488552377-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.omniboxes.com/web/?type=ds&ts=1448631996&z=03deca22d4081fcaf2c9450g7zfz1bbq4c6g4t0t7b&from=ient07021&uid=WDCXWD10JPCX-24UE4T0_WD-WXD1E84EVL7CEVL7C&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2869952153-1275128176-2488552377-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=cornl&utm_campaign=install_ie&utm_content=ds&from=cornl&uid=WDCXWD10JPCX-24UE4T0_WD-WXD1E84EVL7CEVL7C&ts=1438895906&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2869952153-1275128176-2488552377-1001 -> {A88F06F6-C663-4C43-9020-19AF4ADE5222} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=cornl&utm_campaign=install_ie&utm_content=ds&from=cornl&uid=WDCXWD10JPCX-24UE4T0_WD-WXD1E84EVL7CEVL7C&ts=1438895906&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2869952153-1275128176-2488552377-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=cornl&utm_campaign=install_ie&utm_content=ds&from=cornl&uid=WDCXWD10JPCX-24UE4T0_WD-WXD1E84EVL7CEVL7C&ts=1438895906&type=default&q={searchTerms}
BHO-x32: Sale Charger -> {7a38e53c-e000-41e4-9b5a-47447db81c2b} -> C:\Program Files (x86)\Sale Charger\Extensions\7a38e53c-e000-41e4-9b5a-47447db81c2b.dll => Brak pliku
C:\Program Files (x86)\Sale Charger
FF SearchPlugin: C:\Users\Werka\AppData\Roaming\Mozilla\Firefox\Profiles\peshlkid.default\searchplugins\yoursites123.xml [2016-03-10]
FF Extension: Default NewTab - C:\Users\Werka\AppData\Roaming\Mozilla\Firefox\Profiles\peshlkid.default\extensions\default_newtabff@gmail.com [2016-01-04] [Brak podpisu cyfrowego]
DeleteKey: HKLM\SOFTWARE\Wow6432Node\yoursites123Software
DeleteKey: HKU\S-1-5-21-2869952153-1275128176-2488552377-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PriceFountain
DeleteKey: HKU\S-1-5-21-2869952153-1275128176-2488552377-1001\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PriceFountain
Task: {173F84C4-B1C8-4861-88EE-FC34FB80A677} - System32\Tasks\{8580D72B-9FF2-453E-B20E-8766C195082C} => pcalua.exe -a E:\bin\mdac_typ.exe -d E:\bin
Task: {85A84CC0-9979-4C1F-808B-EC246C857B4D} - System32\Tasks\{3A9EADCE-FC58-4D69-A2E2-BB4F45988CCF} => pcalua.exe -a E:\bin\cdviewer.exe -d E:\bin
Task: {EB993D67-18BD-4792-A790-B7A03172F560} - System32\Tasks\Price Fountain => C:\Users\Werka\AppData\Roaming\PriceFountain\UpdateProc\UpdateTask.exe [2016-01-24] () <==== UWAGA
Task: C:\WINDOWS\Tasks\Price Fountain.job => C:\Users\Werka\AppData\Roaming\PRICEF~1\UPDATE~1\UPDATE~1.EXE <==== UWAGA
C:\Users\Werka\AppData\Roaming\PriceFountain
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => Brak pliku
GroupPolicy: Ograniczenia - Chrome <======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: yoursites123
FF Homepage: hxxp://www.yoursites123.com/?type=hp&ts=1451915379&z=45bcd9e398064b0a1f9f6f7g9zfw6gdt6gcw6cdmeb&from=wpm12253&uid=WDCXWD10JPCX-24UE4T0_WD-WXD1E84EVL7CEVL7C
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.yoursites123.com/?type=sc&ts=1457618301&z=4e6d422ded9253e631b1b18g2z5wdm3qfg8b2c7efc&from=wpm06023&uid=WDCXWD10JPCX-24UE4T0_WD-WXD1E84EVL7CEVL7C
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2015-12-09] ()
C:\Windows\System32\DRIVERS\EsgScanner.sys
C:\Users\Werka\Downloads\sh-remover.exe
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

eśli będzie OK, to będziemy kończyć:
Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix (NAPRAW).
przez SHIFT+DEL usuń pozostały folder C:\FRST.

Jeśli natomiast problem nie zniknie, to przeinstalujesz przeglądarkę, na której to jeszcze będzie.
.