Yoursites123

[daw250]

Witam wszystkich!
Za każdym razem gdy otwieram jakąkolwiek przeglądarkę przekierowuje mi stronę startową na yoursites123 niestety nie mogę się z tym uporać i potrzebuję waszej pomocy...

[ordynat]

Otwórz Notatnik i wklej w nim:

DeleteKey: HKLM\SOFTWARE\Wow6432Node\yoursites123Software
ShortcutWithArgument: C:\Users\Dawid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1450095960&z=b503199a9128f4afff4fbe5gdzbwcebe6t9wfb3zdw&from=wpm07173&uid=HitachiXHTS543232L9A300_091005FB2400CEJ5B46AX
ShortcutWithArgument: C:\Users\Dawid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1450095960&z=b503199a9128f4afff4fbe5gdzbwcebe6t9wfb3zdw&from=wpm07173&uid=HitachiXHTS543232L9A300_091005FB2400CEJ5B46AX
ShortcutWithArgument: C:\Users\Dawid\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1450095960&z=b503199a9128f4afff4fbe5gdzbwcebe6t9wfb3zdw&from=wpm07173&uid=HitachiXHTS543232L9A300_091005FB2400CEJ5B46AX
ShortcutWithArgument: C:\Users\Dawid\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WarThunder.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1450095960&z=b503199a9128f4afff4fbe5gdzbwcebe6t9wfb3zdw&from=wpm07173&uid=HitachiXHTS543232L9A300_091005FB2400CEJ5B46AX
ShortcutWithArgument: C:\Users\Dawid\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1450095960&z=b503199a9128f4afff4fbe5gdzbwcebe6t9wfb3zdw&from=wpm07173&uid=HitachiXHTS543232L9A300_091005FB2400CEJ5B46AX
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1450095960&z=b503199a9128f4afff4fbe5gdzbwcebe6t9wfb3zdw&from=wpm07173&uid=HitachiXHTS543232L9A300_091005FB2400CEJ5B46AX
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk -> C:\Program Files\Opera x64\opera.exe (Opera Software) -> hxxp://www.yoursites123.com/?type=sc&ts=1450095960&z=b503199a9128f4afff4fbe5gdzbwcebe6t9wfb3zdw&from=wpm07173&uid=HitachiXHTS543232L9A300_091005FB2400CEJ5B46AX
2015-12-14 13:25 - 2015-10-28 18:26 - 00000000 ____D C:\ProgramData\XWMiniProX
2015-12-14 22:59 - 2015-03-12 14:06 - 00002692 _____ C:\WINDOWS\System32\Tasks\LuckyTab
2015-12-14 13:27 - 2015-12-20 11:07 - 00000000 ____D C:\Program Files (x86)\WinZipper
2015-12-14 13:26 - 2015-12-14 13:26 - 00000392 _____ C:\WINDOWS\SysWOW64\data.bin
2015-12-14 13:26 - 2015-12-14 13:26 - 00000000 ____D C:\Users\Dawid\AppData\Roaming\TSv
2015-12-14 13:25 - 2015-12-14 13:25 - 00000000 ____D C:\ProgramData\8WdM8
StartMenuInternet: (HKLM) Opera - C:\Program Files\Opera x64\Opera.exe hxxp://www.yoursites123.com/?type=sc&ts=1450095960&z=b503199a9128f4afff4fbe5gdzbwcebe6t9wfb3zdw&from=wpm07173&uid=HitachiXHTS543232L9A300_091005FB2400CEJ5B46AX
Edge HomeButtonPage: HKU\S-1-5-21-1754602506-2203393724-2758614670-1001 -> hxxp://www.yoursites123.com/?type=hp&ts=1450095960&z=b503199a9128f4afff4fbe5gdzbwcebe6t9wfb3zdw&from=wpm07173&uid=HitachiXHTS543232L9A300_091005FB2400CEJ5B46AX
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1450095960&z=b503199a9128f4afff4fbe5gdzbwcebe6t9wfb3zdw&from=wpm07173&uid=HitachiXHTS543232L9A300_091005FB2400CEJ5B46AX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://do-search.com/web/?type=ds&ts=1432571765&z=ab61d073d596ed053385918g9zbc7odw6m3gcq8m3z&from=cor&uid=3219913727_67194_447C9A87&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1450095960&z=b503199a9128f4afff4fbe5gdzbwcebe6t9wfb3zdw&from=wpm07173&uid=HitachiXHTS543232L9A300_091005FB2400CEJ5B46AX
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://do-search.com/web/?type=ds&ts=1432571765&z=ab61d073d596ed053385918g9zbc7odw6m3gcq8m3z&from=cor&uid=3219913727_67194_447C9A87&q={searchTerms}
HKU\S-1-5-21-1754602506-2203393724-2758614670-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1450095960&z=b503199a9128f4afff4fbe5gdzbwcebe6t9wfb3zdw&from=wpm07173&uid=HitachiXHTS543232L9A300_091005FB2400CEJ5B46AX
HKU\S-1-5-21-1754602506-2203393724-2758614670-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1450095960&z=b503199a9128f4afff4fbe5gdzbwcebe6t9wfb3zdw&from=wpm07173&uid=HitachiXHTS543232L9A300_091005FB2400CEJ5B46AX
DeleteKey: HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes
DeleteKey: HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes
DeleteKey: HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes
Task: {0A421A2B-9B06-4F42-BD0A-CB881307C215} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Brak pliku <==== UWAGA
Task: {1530C6E6-C89F-4586-9A8D-878B1C94AC54} - System32\Tasks\LuckyTab => C:\Program Files (x86)\LuckyTab\LuckyTab.exe <==== UWAGA
Task: {21EB33EE-386D-469F-BEDF-9A5107CB7917} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Brak pliku <==== UWAGA
C:\Program Files (x86)\LuckyTab
Task: {3CB76783-7C04-460C-918F-05F5F556862A} - System32\Tasks\{84FA28EA-C774-4A87-8E10-2FF7630E27CA} => pcalua.exe -a D:\Download\Win732_105\Setup.exe -d D:\Download\Win732_105
Task: {3FB65E14-9E40-4F06-88B2-84A5A32BFE8D} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Brak pliku <==== UWAGA
Task: {4497DF15-7DD8-4B93-9CF3-EA0CE3A0C115} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Brak pliku <==== UWAGA
Task: {59255143-B4D6-4D46-85F7-FD5B9C788832} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Brak pliku <==== UWAGA
Task: {64C1BCD2-1D4D-44C0-9F5F-A682517A2DFE} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Brak pliku <==== UWAGA
Task: {B630DF62-F3B9-4BF7-8C2C-28E661EB3DFD} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Brak pliku <==== UWAGA
Task: {B7D2D7F7-5215-4954-AA19-573D450A756F} - \ASUSControlDeck -> Brak pliku <==== UWAGA
Task: {B8F7E891-91E5-43DA-803B-DB029529A67C} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Brak pliku <==== UWAGA
Task: {C537ADBD-94C9-44A8-A5A8-D6D0736DFCA5} - System32\Tasks\{D9AD37B1-2854-40BB-9F02-729C84BF4C0B} => pcalua.exe -a D:\Download\flashget3.7.0.1203en.exe -d D:\Download
Task: {C8943DBA-A43B-4CD9-8475-79329A2762B7} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Brak pliku <==== UWAGA
Task: {D5B9AA98-78FF-416F-B040-2D7797085A8C} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Brak pliku <==== UWAGA
Task: {F8EDB0D1-B654-45BE-9449-042374946646} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Brak pliku <==== UWAGA
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - <Brak Path/update_url>
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - <Brak Path/update_url>
FF Session Restore: -> [funkcja włączona]
Toolbar: HKU\S-1-5-21-1754602506-2203393724-2758614670-1001 -> Brak nazwy - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - Brak pliku
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll => Brak pliku
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll => Brak pliku
SearchScopes: HKU\S-1-5-21-1754602506-2203393724-2758614670-1001 -> {6D68D27D-4425-4DC0-94CD-DA60D33A53A6} URL = hxxp://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=888596&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1754602506-2203393724-2758614670-1001 -> {E6EFBEB7-C453-4453-9E0F-7FDE56C9DD82} URL = hxxp://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=902615&p={searchTerms}
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).


----------------------
Jeśli będzie OK, to będziemy kończyć:
Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix (NAPRAW).
przez SHIFT+DEL usuń pozostały folder C:\FRST.

Jeśli natomiast problem nie zniknie, to przeinstalujesz przeglądarkę, na której to jeszcze będzie.
.

Autor postu otrzymał pochwałę

[daw250]

Wielkie dzięki, w końcu wszystko działa jak należy
Piwko dla Ciebie