Problem z yoursites123

Dla specjalistów Bezpieczeństwo
#1

Witam

Mam problem ze stroną główną we wszystkich przeglądarkach. Od wczoraj sama ustawiła się strona yoursites123.com. Używałem AdwCleaner, Anti-Malware, CCleaner ale nic to nie pomogło. Proszę o pomoc.

FRST

Addition

Shortcut

#2

Odinstaluj GeekBuddy.

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hpts=1449648138z=de6186bdc75ae484453b9d2g8z1zateqfzcb3gbzdcfrom=ient07021uid=WDCXWD10EARS-00MVWB0_WD-WMAZA580850408504
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hpts=1449648138z=de6186bdc75ae484453b9d2g8z1zateqfzcb3gbzdcfrom=ient07021uid=WDCXWD10EARS-00MVWB0_WD-WMAZA580850408504
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hpts=1449648138z=de6186bdc75ae484453b9d2g8z1zateqfzcb3gbzdcfrom=ient07021uid=WDCXWD10EARS-00MVWB0_WD-WMAZA580850408504
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hpts=1449648138z=de6186bdc75ae484453b9d2g8z1zateqfzcb3gbzdcfrom=ient07021uid=WDCXWD10EARS-00MVWB0_WD-WMAZA580850408504
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=dsts=1449648138z=de6186bdc75ae484453b9d2g8z1zateqfzcb3gbzdcfrom=ient07021uid=WDCXWD10EARS-00MVWB0_WD-WMAZA580850408504q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=dsts=1449648138z=de6186bdc75ae484453b9d2g8z1zateqfzcb3gbzdcfrom=ient07021uid=WDCXWD10EARS-00MVWB0_WD-WMAZA580850408504q={searchTerms}
FF SelectedSearchEngine: yoursites123
CHR StartupUrls: Default - "hxxp://www.yoursites123.com/?type=hpts=1449648138z=de6186bdc75ae484453b9d2g8z1zateqfzcb3gbzdcfrom=ient07021uid=WDCXWD10EARS-00MVWB0_WD-WMAZA580850408504"
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.yoursites123.com/?type=scts=1449648138z=de6186bdc75ae484453b9d2g8z1zateqfzcb3gbzdcfrom=ient07021uid=WDCXWD10EARS-00MVWB0_WD-WMAZA580850408504
S2 WdMan; C:\ProgramData\6WdM6\WdMan.exe -svr [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwusb_cdcacm; system32\DRIVERS\ew_cdcacm.sys [X]
S3 hwusb_wwanecm; system32\DRIVERS\ew_wwanecm.sys [X]
S4 NVHDA; system32\drivers\nvhda64v.sys [X]
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [X]
2015-12-10 09:17 - 2015-12-10 09:37 - 00000000 ____ D C:\AdwCleaner
ShortcutWithArgument: C:\Users\ISO\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) - hxxp://www.yoursites123.com/?type=scts=1449648138z=de6186bdc75ae484453b9d2g8z1zateqfzcb3gbzdcfrom=ient07021uid=WDCXWD10EARS-00MVWB0_WD-WMAZA580850408504 ==== UWAGA
ShortcutWithArgument: C:\Users\ISO\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) - hxxp://www.yoursites123.com/?type=scts=1449648138z=de6186bdc75ae484453b9d2g8z1zateqfzcb3gbzdcfrom=ient07021uid=WDCXWD10EARS-00MVWB0_WD-WMAZA580850408504 ==== UWAGA
ShortcutWithArgument: C:\Users\ISO\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) - hxxp://www.yoursites123.com/?type=scts=1449648138z=de6186bdc75ae484453b9d2g8z1zateqfzcb3gbzdcfrom=ient07021uid=WDCXWD10EARS-00MVWB0_WD-WMAZA580850408504 ==== UWAGA
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) - hxxp://www.yoursites123.com/?type=scts=1449648138z=de6186bdc75ae484453b9d2g8z1zateqfzcb3gbzdcfrom=ient07021uid=WDCXWD10EARS-00MVWB0_WD-WMAZA580850408504 ==== UWAGA
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) - hxxp://www.yoursites123.com/?type=scts=1449648138z=de6186bdc75ae484453b9d2g8z1zateqfzcb3gbzdcfrom=ient07021uid=WDCXWD10EARS-00MVWB0_WD-WMAZA580850408504 ==== UWAGA
EmptyTemp:

Uruchom FRST i kliknij Napraw (Fix). Pokaż raport z usuwania Fixlog.

 

#3

Fixlog

Shortcut

#4

Skasuj folder C:\FRST

#5

Wszystko wróciło do normy. Dziękuje bardzo za pomoc.