Problem z robakiem przeglądarkowym Yoursites123

[matber]

Witam.

Mam na przeglądarce Google Chrome wirusa Yoursites123. Nie mam pojęcia jak go usunąć. Nie ma go w rozszerzeniach, nie ma go w Dodaj lub usuń programy, antywirus (AVG) nie wykrył żadnych wirusów. 

Co mogę zrobić? 

[Atis]

Nie potrafisz przeczytać przypiętych tematów?

Farbar Recovery Scan Tool - Raport obowiązkowy

[matber]

Wybacz.

O to wyniki skanowania:

http://www.wklej.org/id/2767917/

http://www.wklej.org/id/2767919/

http://www.wklej.org/id/2767920/

Co dalej?

[Atis]

Pobierz i uruchom AdwCleaner Kliknij Skanuj (Scan) i później Usuń (Cleaning).
Kliknij Skanuj (Scan) i pokaż nowy raport z FRST bez Addition i Shortcut.

[matber]

Od razu po przeczyszczeniu AdwCleanerem widać różnicę ponieważ nie było już Yoursite123 na stronie startowej

Raport z AdwCleaner: http://www.wklej.org/id/2767974/ 

Raport z FRST: http://www.wklej.org/id/2767976/

[Atis]

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA FF SearchPlugin: C:\Users\Mateusz\AppData\Roaming\Mozilla\Firefox\Profiles\af1tg1bs.default\searchplugins\yoursites123.xml [2016-03-25] S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2945312 2016-01-14] (IObit) 2016-07-19 22:36 - 2016-07-19 22:39 - 00000000 ____D C:\AdwCleaner 2016-07-07 12:12 - 2016-07-07 12:26 - 0828671 ____N () C:\Users\Mateusz\AppData\Local\Tempmusic.ogg CustomCLSID: HKU\S-1-5-21-2233151511-893118297-1520862889-1000_Classes\CLSID{2D611968-B0FB-4B81-8AFA-D7486879D141}\InprocServer32 -> Rnvrcs.dll => Brak pliku Task: {4A22C825-1B30-493F-B25B-119AA114EC46} - System32\Tasks\klcp_update => C:\Program Files\K-Lite Codec Pack\Tools\CodecTweakTool.exe [2015-11-30] () Task: {6124268F-F39B-44C6-AAC5-FE26632507E5} - System32\Tasks\Driver Booster SkipUAC (Mateusz) => C:\Program Files\IObit\Driver Booster\DriverBooster.exe Task: {DC2A07B7-9A03-4C28-BF18-5EC478D7A4FF} - System32\Tasks\Price Fountain => C:\Users\Mateusz\AppData\Roaming\PRICEF~1\UPDATE~1\UPDATE~1.EXE <==== UWAGA Task: C:\Windows\Tasks\Price Fountain.job => C:\Users\Mateusz\AppData\Roaming\PRICEF~1\UPDATE~1\UPDATE~1.EXE <==== UWAGA ShortcutWithArgument: C:\Users\Mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1458888953&z=5a2972cf1e0280b1dde93bdg1zaw1bcb2b0tdedtab&from=wpm0314&uid=WDCXWD3200AUDX-56WNHY0_WD-WMC1U473964339643 ShortcutWithArgument: C:\Users\Mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1458888953&z=5a2972cf1e0280b1dde93bdg1zaw1bcb2b0tdedtab&from=wpm0314&uid=WDCXWD3200AUDX-56WNHY0_WD-WMC1U473964339643 ShortcutWithArgument: C:\Users\Mateusz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1458888953&z=5a2972cf1e0280b1dde93bdg1zaw1bcb2b0tdedtab&from=wpm0314&uid=WDCXWD3200AUDX-56WNHY0_WD-WMC1U473964339643 ShortcutWithArgument: C:\Users\Mateusz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1458888953&z=5a2972cf1e0280b1dde93bdg1zaw1bcb2b0tdedtab&from=wpm0314&uid=WDCXWD3200AUDX-56WNHY0_WD-WMC1U473964339643 ShortcutWithArgument: C:\Users\Mateusz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WarThunder.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1458888953&z=5a2972cf1e0280b1dde93bdg1zaw1bcb2b0tdedtab&from=wpm0314&uid=WDCXWD3200AUDX-56WNHY0_WD-WMC1U473964339643 ShortcutWithArgument: C:\Users\Mateusz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1458888953&z=5a2972cf1e0280b1dde93bdg1zaw1bcb2b0tdedtab&from=wpm0314&uid=WDCXWD3200AUDX-56WNHY0_WD-WMC1U473964339643 ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1458888953&z=5a2972cf1e0280b1dde93bdg1zaw1bcb2b0tdedtab&from=wpm0314&uid=WDCXWD3200AUDX-56WNHY0_WD-WMC1U473964339643 ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1458888953&z=5a2972cf1e0280b1dde93bdg1zaw1bcb2b0tdedtab&from=wpm0314&uid=WDCXWD3200AUDX-56WNHY0_WD-WMC1U473964339643 ShortcutWithArgument: C:\Users\Public\Desktop\Play Euro Truck Simulator 2 Multiplayer.lnk -> D:\Programy\Steam\steamapps\common\Euro Truck Simulator 2\Euro Truck Simulator 2 Multiplayer\launcher.exe (ETS2MP Team) -> hxxp://www.yoursites123.com/?type=sc&ts=1458888953&z=5a2972cf1e0280b1dde93bdg1zaw1bcb2b0tdedtab&from=wpm0314&uid=WDCXWD3200AUDX-56WNHY0_WD-WMC1U473964339643 EmptyTemp:

Uruchom FRST i kliknij Napraw (Fix). Pokaż raport z usuwania Fixlog.
Kliknij Skanuj (Scan) i pokaż nowy raport z FRST bez Addition i Shortcut.