Pliki youku

**Posty:** 7 · przez **margaretka91** 16 Paź 2016, 11:00

Dzień dobry. Podczas ściągania programu zainstalował się jakiś robak. Próbowałam go usunąć ale bezskutecznie. Czasem wyskakuje jakieś okienko z chińskimi napisami
Wklejam mam nadzieję wszystko co potrzebne

Dziękuje za pomoc!

**Posty:** 4765 · przez **ordynat** 16 Paź 2016, 12:44

Log FRST.txt jest ... pusty.

1) Otwórz Notatnik i wklej w nim:

CustomCLSID: HKU\S-1-5-21-1345097060-266051943-715220193-1000_Classes\CLSID\{5ed339e2-e6a7-576a-be70-fb9cdbdce50e}\InprocServer32 -> C:\Users\Willy\AppData\Roaming\ytmediacenter\X64\npYoukuAgent_x64.dll (Youku)
RemoveDirectory: C:\Users\Willy\AppData\Roaming\ytmediacenter
RemoveDirectory: C:\Program Files (x86)\UCBrowser
RemoveDirectory: C:\Program Files (x86)\YouKu
RemoveDirectory: C:\Users\Willy\AppData\Roaming\youku
RemoveDirectory: C:\Program Files (x86)\EasyHotspot
RemoveDirectory: C:\Users\Willy\AppData\Local\Tempfolder
RemoveDirectory: C:\Program Files\AiduwbUn
RemoveDirectory: C:\Program Files\Aiduwb
RemoveDirectory: C:\ProgramData\Avira
RemoveDirectory: C:\ProgramData\Avg
RemoveDirectory: C:\ProgramData\boost_interprocess
RemoveDirectory: C:\Users\Willy\AppData\Roaming\Ckomary
RemoveDirectory: C:\Users\Willy\AppData\Local\Apps
RemoveDirectory: C:\Users\Willy\AppData\Local\Vholecepy
RemoveDirectory: C:\Users\Willy\AppData\Roaming\Profiles
RemoveDirectory: C:\Program Files (x86)\Anocitvikoph
RemoveDirectory: C:\Users\Willy\AppData\Local\03000200-1476486294-0500-0006-000700080009
RemoveDirectory: C:\Users\Willy\AppData\Roaming\KuaiZip
RemoveDirectory: C:\Users\Willy\AppData\Roaming\Softlink
RemoveDirectory: C:\Users\Willy\AppData\Local\UCBrowser
RemoveDirectory: C:\Users\Willy\AppData\Local\app
RemoveDirectory: C:\Program Files (x86)\hhh
RemoveDirectory: C:\Program Files (x86)\WeatherChickn
RemoveDirectory: C:\Program Files (x86)\Microleaves
RemoveDirectory: C:\Windows\SysWow64\%APPDATA%
RemoveDirectory: C:\Users\Willy\AppData\Roaming\Microleaves
C:\Users\Willy\Documents\优酷影视库
Task: {EAD0E476-04D8-454D-B14B-F4419D65BF11} - System32\Tasks\UCBrowserUpdater => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2016-08-02] (UCWeb Inc) <==== UWAGA
Task: C:\Windows\Tasks\UCBrowserUpdater.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== UWAGA
FirewallRules: [{DCCD1AFC-2F2C-48B9-80D1-65A55C4B672F}] => (Allow) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
FirewallRules: [{4C4971ED-93EA-496F-9AF2-85EEC86703AA}] => (Allow) C:\Program Files (x86)\UCBrowser\Application\Downloader\download\MiniThunderPlatform.exe
FirewallRules: [{87392641-0605-4F3F-9417-7EE8B60E2227}] => (Allow) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
FirewallRules: [{461A7ABF-F308-4D45-ABCD-2FDF6EDC7F53}] => (Allow) C:\Users\Willy\AppData\Roaming\youku\..\ytmediacenter\ikuacc.exe
FirewallRules: [{610B5B65-71BB-419A-A092-DD086364EEC5}] => (Allow) C:\Users\Willy\AppData\Roaming\youku\..\ytmediacenter\ikuacc.exe
C:\Windows\SysNative\drivers\ucguard.sys
C:\TOSTACK
C:\Users\Willy\AppData\Roaming\agent.dat
C:\Users\Willy\AppData\Roaming\Main.dat
C:\Users\Willy\AppData\Roaming\Installer.dat
C:\Users\Willy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\UC浏览器.lnk
C:\Users\Willy\Documents\优酷影视库\【别对妈说谎】07孕期养宠物真的会感染弓形虫吗？.lnk
FindFolder: YouKu
FindFolder: ytmediacenter
HOSTS:
EmptyTemp:

>>Menu Notatnika >> Plik >>
>>Zapisz jako >>
Nazwa pliku: fixlist
Zapisz jako typ: Dokumenty tekstowe
Kodowanie: Unicode
>>Zapisz
Plik umieść w folderze C:\Users\Willy\Downloads
Uruchom FRST i kliknij przycisk Fix (NAPRAW).
Daj ten log.

2) Uruchom FRST.
W polu SEARCH (SZUKAJ) wklej:

YouKu*.*; ytmediacenter

kliknij na przycisk "Search Files (Szukaj Plików)".
Raport z tego będzie tam, gdzie jest FRST.

3) Uruchom FRST.
W polu SEARCH (SZUKAJ) wklej:

YouKu;ytmediacenter

kliknij na przycisk "Search Registry" (Szukaj w Rejestrze).
Raport z tego będzie tam, gdzie jest FRST.

4) Zrób nowe logi FRST.
Przed skanem zaznacz "Addition.txt" oraz "Shortcut.txt"
.

**Posty:** 7 · przez **margaretka91** 16 Paź 2016, 14:38

Wklejam wszystko:

**Posty:** 4765 · przez **ordynat** 16 Paź 2016, 16:01

1) Do Notatnika wklej:

Spoiler:

Z Menu Notatnika >> Plik >> Zapisz jako >> Ustaw rozszerzenie na Wszystkie pliki >> Zapisz jako> FIX.REG >>
plik uruchom (dwuklik i OK).

2) Otwórz Notatnik i wklej w nim:

HKLM-x32\...\Run: [YoukuMediaCenter] => "C:\Users\Willy\AppData\Roaming\ytmediacenter\YoukuMediaCenter.exe" iku://
RemoveDirectory: C:\Users\Willy\AppData\Roaming\ytmediacenter
RemoveDirectory: C:\Program Files (x86)\YouKu
RemoveDirectory: C:\Program Files (x86)\GUM6DDF.tmp
RemoveDirectory: D:\Youku Files
RemoveDirectory: C:\Users\Willy\Documents\Youku Files
RemoveDirectory: C:\Users\Willy\AppData\Roaming\youku
HKU\S-1-5-18\...\Run: [] => 0
ShellIconOverlayIdentifiers: [ Report64] -> {C7D0BD5D-B11A-47DB-BB14-7F930B3F7705} => C:\Users\Willy\AppData\Roaming\ytmediacenter\X64\report64.dll Brak pliku
ShellIconOverlayIdentifiers: [ YoukuModShlExt64] -> {314711D6-6B45-4AF7-83D8-DCD8537FD241} => C:\Users\Willy\AppData\Roaming\ytmediacenter\X64\coreplay64.dll Brak pliku
ShellIconOverlayIdentifiers: [KzShlobj2] -> {AAA0C5B8-933F-4200-93AD-B143D7FFF9F3} => Brak pliku
ShellIconOverlayIdentifiers-x32: [ Report] -> {32C50D96-7A9E-4F3E-8763-F74D86AFEDC2} => C:\Users\Willy\AppData\Roaming\ytmediacenter\report.dll Brak pliku
ShellIconOverlayIdentifiers-x32: [ YoukuModShlExt] -> {9071723E-9F41-4A8C-9CC2-EB6F94BA9B9E} => C:\Users\Willy\AppData\Roaming\ytmediacenter\coreplay.dll Brak pliku
SearchScopes: HKU\S-1-5-21-1345097060-266051943-715220193-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: YoukuEyeOnIE64 Class -> {509DC5B8-F673-4102-B86E-5BF20BF4EE54} -> C:\Users\Willy\AppData\Roaming\ytmediacenter\X64\ykcool64.dll => Brak pliku
BHO-x32: YoukuEyeOnIE Class -> {7DC4B5B6-C122-44C4-825C-B310513A47CB} -> C:\Users\Willy\AppData\Roaming\ytmediacenter\ykcool.dll => Brak pliku
FF Plugin HKU\S-1-5-21-1345097060-266051943-715220193-1000: youku.com/YoukuAgent -> C:\Users\Willy\AppData\Roaming\ytmediacenter\npYoukuAgent.dll [Brak pliku]
FF Plugin HKU\S-1-5-21-1345097060-266051943-715220193-1000: youku.com/YoukuAgent_x86_64 -> C:\Users\Willy\AppData\Roaming\ytmediacenter\X64\npYoukuAgent_x64.dll [Brak pliku]
CHR DefaultProfile: ChromeDefaultData
CHR StartupUrls: ChromeDefaultData -> "hxxp://google.pl/"
CHR Profile: C:\Users\Willy\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2016-10-16] <==== UWAGA
CHR Extension: (Browser Hunt) - C:\Users\Willy\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdckocnfhibclnnkifmjbbogcfkbijki [2016-10-14]
S2 MicrosoftNETIntel; "C:\Program Files (x86)\Microsoft.NET\MicrosoftNETIntel.exe" 420f678469254505a655a4b567f7c9a0 [X]
S2 NowyfolderNowyfolder; "D:\Nowy folder\NowyfolderNowyfolder.exe" affe6dc7e5264e7e8e5695737342bee0 [X]
S2 RaymanOriginsYoukuFiles; "D:\Youku Files\RaymanOriginsYoukuFiles.exe" 3e19779b2974487e881c2174c0562504 [X]
S2 TheWitcherWildHuntNowyfolder; "D:\The Witcher 3 Wild Hunt\TheWitcherWildHuntNowyfolder.exe" b48f42ba07304dd38f2ef02dfd46c678 [X]
S2 UCBrowserGUMDDFtmp; "C:\Program Files (x86)\GUM6DDF.tmp\UCBrowserGUMDDFtmp.exe" e47b5abf08794d6b8b774f94eeb062f4 [X]
S2 WebServe; C:\Program Files (x86)\YouKu\YoukuClient\WebServe.exe [X]
R1 UCGuard; C:\Windows\System32\DRIVERS\ucguard.sys [81792 2016-08-02] (Huorong Borui (Beijing) Technology Co., Ltd.) <==== UWAGA
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
C:\Windows\System32\DRIVERS\ucguard.sys
C:\Windows\System32\Tasks\9dd380cf4802e2308349e760d3d921f7
StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS]
"Progid"=""

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS]
"Application"=""

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithProgids]
"Youku.ts"=-

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\Progid]
""=""

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\UserChoice]
"Progid"="WMP11.AssocFile.TTS"

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\UserChoice\Progid]
""="WMP11.AssocFile.TTS"

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vob]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vob]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vob\OpenWithProgids]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vob\Progid]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vob\UserChoice]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vob\UserChoice\Progid]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.VRO]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.VRO\OpenWithProgids]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.VRO\Progid]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.VRO\UserChoice]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.VRO\UserChoice\Progid]

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv]
"Progid"=""

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv]
"Application"=""

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithProgids]
"Youku.wmv"=-

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\Progid]
""=""

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice]
"Progid"="WMP11.AssocFile.WMV"

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice\Progid]
""=""

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Run]
"YoukuMediaCenter"=-

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Run]
"iKu"=-

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\MozillaPlugins\youku.com/YoukuAgent]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\MozillaPlugins\youku.com/YoukuAgent_x86_64]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\YouKu]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\YouKu\YoukuClient]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\AppID\npYoukuAgent.dll]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\Applications\YoukuDesktop.exe]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\Applications\YoukuDesktop.exe\shell\使用优酷打开\command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\MIME\DataBase\Content Type\application/x-youkuagent]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.3GP\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.ASF\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.AVI\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.DV\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.DVIX\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.F4V\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.FLV\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.kux\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.M1V\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.M2TS\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.M2V\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.M4V\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MKV\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MOV\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MP2\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MP4\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MPEG\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MPEG1\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MPEG2\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MPEG4\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MPG\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MTS\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MTV\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MXF\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.OGG\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.OGM\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.OGV\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.OGX\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.RM\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.RMVB\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.TS\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.VOB\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.VRO\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.WMV\Shell\使用优酷打开\Command]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\TypeLib\{41BD6190-7FEE-52CD-970F-01C876E8C4FA}\1.0]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\TypeLib\{41BD6190-7FEE-52CD-970F-01C876E8C4FA}\1.0\0\win32]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\Wow6432Node\CLSID\{5ed339e2-e6a7-576a-be70-fb9cdbdce50e}]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\Wow6432Node\CLSID\{5ed339e2-e6a7-576a-be70-fb9cdbdce50e}\InprocServer32]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\Wow6432Node\CLSID\{5ed339e2-e6a7-576a-be70-fb9cdbdce50e}\ProgID]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\Wow6432Node\CLSID\{5ed339e2-e6a7-576a-be70-fb9cdbdce50e}\VersionIndependentProgID]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\Youku.YoukuAgent]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\Youku.YoukuAgent\CurVer]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\Youku.YoukuAgent.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{314711D6-6B45-4AF7-83D8-DCD8537FD241}\InprocServer32]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{509DC5B8-F673-4102-B86E-5BF20BF4EE54}\InprocServer32]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7D0BD5D-B11A-47DB-BB14-7F930B3F7705}\InprocServer32]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iKu\DefaultIcon]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iKu\Shell\open\command]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{05CC52F3-974B-4002-8D56-ADCBD0E4AA66}\1.0\0\win32]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{05CC52F3-974B-4002-8D56-ADCBD0E4AA66}\1.0\HELPDIR]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2A47137C-F777-419F-A47A-7C8BB9B8F796}\1.0\0\win32]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2A47137C-F777-419F-A47A-7C8BB9B8F796}\1.0\HELPDIR]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2F5FF192-A1D6-4630-89A4-715A59C25ADF}\1.0\0\win32]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2F5FF192-A1D6-4630-89A4-715A59C25ADF}\1.0\HELPDIR]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{69D2B843-2F9B-4E8D-8EE5-CC6510FABCB8}\1.0\0\win32]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{69D2B843-2F9B-4E8D-8EE5-CC6510FABCB8}\1.0\HELPDIR]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6F99703C-6E6E-469E-B709-5FBB21E66122}\1.0\0\win32]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6F99703C-6E6E-469E-B709-5FBB21E66122}\1.0\HELPDIR]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A3092E67-6E77-41F2-9A56-B15AC58B8C51}\1.0\0\win32]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A3092E67-6E77-41F2-9A56-B15AC58B8C51}\1.0\HELPDIR]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18E158C6-48EE-4411-A26A-B26334E238A2}\Shell\delete\command]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18E158C6-48EE-4411-A26A-B26334E238A2}\Shell\open\command]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32C50D96-7A9E-4F3E-8763-F74D86AFEDC2}\InprocServer32]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DC4B5B6-C122-44C4-825C-B310513A47CB}\InprocServer32]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9071723E-9F41-4A8C-9CC2-EB6F94BA9B9E}\InprocServer32]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAAD9C7A-8AE3-4395-A121-4096565A6698}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"YoukuMediaCenter"=-

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Run]
"YoukuMediaCenter"=-

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\MozillaPlugins\youku.com/YoukuAgent]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\MozillaPlugins\youku.com/YoukuAgent_x86_64]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\YouKu\iKuAcc]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\TypeLib\{41BD6190-7FEE-52CD-970F-01C876E8C4FA}\1.0\0\win32]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\TypeLib\{41BD6190-7FEE-52CD-970F-01C876E8C4FA}\1.0\HELPDIR]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\Wow6432Node\CLSID\{5ed339e2-e6a7-576a-be70-fb9cdbdce50e}\InprocServer32]

EndRegedit:
EmptyTemp:

>>Menu Notatnika >> Plik >>
>>Zapisz jako >>
Nazwa pliku: fixlist
Zapisz jako typ: Dokumenty tekstowe
Kodowanie: Unicode
>>Zapisz
Plik umieść w folderze C:\Users\Willy\Downloads
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

3) Użyj RepairDNS > http://www.fixitpc.pl/topic/8-dezynfekcja-zbi%C3%B3r-narz%C4%99dzi-usuwaj%C4%85cych/#entry172749
Link zapasowy > http://www.mediafire.com/download/yedejtr7p4q36zm/RepairDNS.zip
Daj z tego raport.

4) Zrób nowe logi FRST - już bez Shortcut.

5) Zrób takie same wyszukiwania, jak poprzednio (tzn. YouKu;ytmediacenter )
.

**Posty:** 7 · przez **margaretka91** 17 Paź 2016, 09:54

Wykonałam punkt 1 a jak robię punkt 2,- uruchom FRST I klikam FIX, to wtedy program po chwili zawiesza się i nie udaje się naprawić. Już trzykrotnie próbowałam wykonać naprawianie i bezskutecznie. Pojawia się komunikat na górze pasku programu, że program nie odpowiada

**Posty:** 4765 · przez **ordynat** 17 Paź 2016, 10:40

rób następne kroki.
zobaczymy, co się usunęło, a co nie.
.

**Posty:** 7 · przez **margaretka91** 17 Paź 2016, 11:28

Umieszczam pliki

**Posty:** 4765 · przez **ordynat** 17 Paź 2016, 11:31

1) W Google Chrome jest ustawiony jako domyślny profil adware (nazwa na dysku ChromeDefaultData, ale w opcjach prawdopodobnie user0). Wymagana całkowita zmiana profilu.
Menu Ustawienia > karta Ustawienia > Osoby > Dodaj nową osobę i uruchom Chrome z poziomu tego profilu, a okno poprzedniego zamknij.
Następnie w ustawieniach skasuj poprzedni profil.

2) Otwórz Notatnik i wklej w nim:

ShellIconOverlayIdentifiers: [ Report64] -> {C7D0BD5D-B11A-47DB-BB14-7F930B3F7705} => Brak pliku
ShellIconOverlayIdentifiers: [ YoukuModShlExt64] -> {314711D6-6B45-4AF7-83D8-DCD8537FD241} => Brak pliku
ShellIconOverlayIdentifiers-x32: [ Report] -> {32C50D96-7A9E-4F3E-8763-F74D86AFEDC2} => Brak pliku
ShellIconOverlayIdentifiers-x32: [ YoukuModShlExt] -> {9071723E-9F41-4A8C-9CC2-EB6F94BA9B9E} => Brak pliku
HR DefaultProfile: ChromeDefaultData
CHR Profile: C:\Users\Willy\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2016-10-17] <==== UWAGA
C:\Users\Willy\AppData\Local\Google\Chrome\User Data\ChromeDefaultData
R1 UCGuard; C:\Windows\System32\DRIVERS\ucguard.sys [81792 2016-08-02] (Huorong Borui (Beijing) Technology Co., Ltd.) <==== UWAGA
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
C:\Windows\System32\DRIVERS\ucguard.sys
Replace: C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7\dnsapi.dll C:\Windows\SysWOW64\dnsapi.dll
StartRegedit:
Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18E158C6-48EE-4411-A26A-B26334E238A2}\Shell\open\command]

[HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Run]
"YoukuMediaCenter"=-

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\YouKu\iKuAcc]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\TypeLib\{41BD6190-7FEE-52CD-970F-01C876E8C4FA}\1.0\0\win32]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\TypeLib\{41BD6190-7FEE-52CD-970F-01C876E8C4FA}\1.0\HELPDIR]

[-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\Wow6432Node\CLSID\{5ed339e2-e6a7-576a-be70-fb9cdbdce50e}\InprocServer32]
EndRegedit:
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

3) Do Notatnika wklej:

Spoiler:

Z Menu Notatnika >> Plik >> Zapisz jako >> Ustaw rozszerzenie na Wszystkie pliki >> Zapisz jako> FIX.REG >>
plik uruchom (dwuklik i OK).
Zrestartuj komputer.

4) Zrób nowe logi FRST

5) Zrób takie same wyszukiwania, jak poprzednio.
.
...

**Posty:** 7 · przez **margaretka91** 18 Paź 2016, 07:38

Wszystko zrobione oprócz czynności napraw- program zawiesza się po chwili

**Posty:** 4765 · przez **ordynat** 18 Paź 2016, 12:08

1) Do Notatnika wklej:

Spoiler:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18E158C6-48EE-4411-A26A-B26334E238A2}\Shell\open\command] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ YoukuModShlExt64] [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers\ YoukuModShlExt] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dv\OpenWithProgids] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVIX\OpenWithProgids] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.f4v\OpenWithProgids] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flv\OpenWithProgids] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.KUX\OpenWithProgids] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithProgids] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithProgids] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mkv] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MPEG1] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTV] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogm] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogv] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.OGX] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rm] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmvb] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vob] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.VRO] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv] [HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Run] "YoukuMediaCenter"=- [HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Run] "iKu"=- [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\YouKu] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\AppID\npYoukuAgent.dll] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\Applications\YoukuDesktop.exe] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\MIME\DataBase\Content Type\application/x-youkuagent] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.3GP\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.ASF\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.AVI\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.DV\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.DVIX\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.F4V\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.FLV\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.kux\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.M1V\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.M2TS\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.M2V\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.M4V\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MKV\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MOV\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MP2\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MP4\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MPEG\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MPEG1\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MPEG2\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MPEG4\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MPG\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MTS\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MTV\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.MXF\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.OGG\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.OGM\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.OGV\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.OGX\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.RM\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.RMVB\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.TS\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.VOB\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.VRO\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\SystemFileAssociations\.WMV\Shell\使用优酷打开\Command] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\TypeLib\{41BD6190-7FEE-52CD-970F-01C876E8C4FA}\1.0] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\Wow6432Node\CLSID\{5ed339e2-e6a7-576a-be70-fb9cdbdce50e}] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\Youku.YoukuAgent] [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Classes\Youku.YoukuAgent.1] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18E158C6-48EE-4411-A26A-B26334E238A2}\Shell\open\command] [HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\Microsoft\Windows\CurrentVersion\Run] "YoukuMediaCenter"=- [-HKEY_USERS\S-1-5-21-1345097060-266051943-715220193-1000\Software\YouKu\iKuAcc] [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf] [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithProgids] "WMP11.AssocFile.ASF"=hex(0): [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\UserChoice] "Progid"="WMP11.AssocFile.ASF" [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi] [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList] "a"="wmplayer.exe" "MRUList"="a" [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithProgids] "WMP11.AssocFile.AVI"=hex(0): [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice] "Progid"="WMP11.AssocFile.AVI" [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v] [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithProgids] "WMP11.AssocFile.MPEG"=hex(0): [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\UserChoice] "Progid"="WMP11.AssocFile.MPEG" [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2ts] [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2ts\OpenWithProgids] "WMP11.AssocFile.M2TS"=hex(0): [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2ts\UserChoice] "Progid"="WMP11.AssocFile.M2TS" [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2v] [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2v\OpenWithProgids] "WMP11.AssocFile.MPEG"=hex(0): [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2v\UserChoice] "Progid"="WMP11.AssocFile.MPEG" [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v] [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithProgids] "WMP11.AssocFile.MP4"=hex(0): [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\UserChoice] "Progid"="WMP11.AssocFile.MP4" [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov] [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithProgids] "WMP11.AssocFile.MOV"=hex(0): [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\UserChoice] "Progid"="WMP11.AssocFile.MOV" [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2] [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithProgids] "WMP11.AssocFile.MP3"=hex(0): [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice] "Progid"="WMP11.AssocFile.MP3" [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4] [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList] "a"="wmplayer.exe" "MRUList"="a" [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithProgids] "WMP11.AssocFile.MP4"=hex(0): [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice] "Progid"="WMP11.AssocFile.MP4" [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg] [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithProgids] "WMP11.AssocFile.MPEG"=hex(0): [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\UserChoice] "Progid"="WMP11.AssocFile.MPEG" [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg] [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithProgids] "WMP11.AssocFile.MPEG"=hex(0): [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice] "Progid"="WMP11.AssocFile.MPEG" [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mts] [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mts\OpenWithProgids] "WMP11.AssocFile.M2TS"=hex(0): [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mts\UserChoice] "Progid"="WMP11.AssocFile.M2TS" [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ts] [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ts\OpenWithProgids] "WMP11.AssocFile.TTS"=hex(0): [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ts\UserChoice] "Progid"="WMP11.AssocFile.TTS" [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv] [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithProgids] "WMP11.AssocFile.WMV"=hex(0): [HKEY_USERS\S-1-5-21-1908891989-2600099311-2743488440-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice] "Progid"="WMP11.AssocFile.WMV"

>>Menu Notatnika >> Plik >>
>>Zapisz jako >>
Nazwa pliku: Fix.Reg
Zapisz jako typ: Wszystkie pliki
Kodowanie: UTF-8
>>Zapisz (np, na pulpicie)
plik uruchom (dwuklik i OK).

2) Otwórz Notatnik i wklej w nim:

Task: {950AF505-5199-4D07-85FB-DB21887A7D25} - System32\Tasks\9dd380cf4802e2308349e760d3d921f7 => Rundll32.exe "C:\Program Files (x86)\OpenOffice.org 2.4\0ulsmf.dll",e62dc6c6547f46bda862da2d05af6862
C:\Program Files (x86)\OpenOffice.org 2.4\0ulsmf.dll
ShellIconOverlayIdentifiers: [ Report64] -> {C7D0BD5D-B11A-47DB-BB14-7F930B3F7705} => Brak pliku
ShellIconOverlayIdentifiers: [ YoukuModShlExt64] -> {314711D6-6B45-4AF7-83D8-DCD8537FD241} => Brak pliku
ShellIconOverlayIdentifiers-x32: [ Report] -> {32C50D96-7A9E-4F3E-8763-F74D86AFEDC2} => Brak pliku
ShellIconOverlayIdentifiers-x32: [ YoukuModShlExt] -> {9071723E-9F41-4A8C-9CC2-EB6F94BA9B9E} => Brak pliku
R1 UCGuard; C:\Windows\System32\DRIVERS\ucguard.sys [81792 2016-08-02] (Huorong Borui (Beijing) Technology Co., Ltd.) <==== UWAGA
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
C:\Windows\System32\DRIVERS\ucguard.sys
Replace: C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7\dnsapi.dll C:\Windows\SysWOW64\dnsapi.dll
D:\Youku Files
C:\Program Files (x86)\YouKu
C:\Users\Willy\AppData\Roaming\ytmediacenter
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

Jeśli nie nie uda się to "Napraw", to zrobisz to w Trybie Awaryjnym (F8 przed startem Systemu)

3) Zrób nowe logi FRST.
Przed skanem zaznacz "Addition.txt"
.

**Posty:** 7 · przez **margaretka91** 19 Paź 2016, 14:42

nie mogę wykonać punktu 1.... po zapisaniu pliku w notatniku i próbie kliknięcia go pojawia się następujący komunikat: Nie można zaimportować pliku0 plik nie jest skryptem rejestru. Można importować tylko binarne pliki rejestru z wewnątrz Edytowa rejestru

**Posty:** 4765 · przez **ordynat** 19 Paź 2016, 16:33

To by wskazywało albo na niewklejenie nagłówka Skryptu, (czyli Windows Registry Editor Version 5.00)
albo na to, że w nazwie pliku po "Fix.Reg" pojawił się ".txt"
(powinno być tylko "Fix.Reg", a nie "Fix.Reg.txt"

**Posty:** 7 · przez **margaretka91** 20 Paź 2016, 08:40

Jeszcze raz wkleiłam plik , w nagłówku znajduje się napis Windows Registry Editor Version 5.00. Rozszerzenie też jest prawidłowe a plik nadal nie daje się uruchomić. Próbowałam go zapisać na pulpicie i w folderze pobrane i dalej nic

**Posty:** 4765 · przez **ordynat** 20 Paź 2016, 09:23

W takim razie masz jakiś dziwny System.
Trudno, nic na to nie poradzę.
.

Kto jest na forum