x-kom hosting

yoursites123

barto81
utworzono
utworzono

Witam

 

 

          Problem jak już zauważłem dość znany. Proszę o pomoc w usunięciu yoursites123.

 

 

Pozdrawiam

 

Twój_Anioł_Stróż
komentarz
komentarz (edytowane)

1) Odinstaluj ten program:

Picexa (HKLM-x32\...\Picexa) (Version:  - Taiwan Shui Mu Chih Ching Technology Limited) <==== ATTENTION

 

2) Otwórz Notatnik i wklej w nim:

CustomCLSID: HKU\S-1-5-21-389168763-3466295262-423288256-1002_Classes\CLSID\{FE054BB2-AF94-40AC-88AA-2F59F7018B1D}\InprocServer32 -> axdb.dll => No File
CustomCLSID: HKU\S-1-5-21-389168763-3466295262-423288256-1002_Classes\CLSID\{FE317223-8EDE-4684-B424-E48B9EA90220}\InprocServer32 -> axdb.dll => No File
CustomCLSID: HKU\S-1-5-21-389168763-3466295262-423288256-1002_Classes\CLSID\{FE718E8F-C3AA-4F30-9103-432450CF1DA1}\InprocServer32 -> axdb.dll => No File
CustomCLSID: HKU\S-1-5-21-389168763-3466295262-423288256-1002_Classes\CLSID\{E70DE962-842A-4488-9481-1D0FD72A020F}\InprocServer32 -> axdb.dll => No File
CustomCLSID: HKU\S-1-5-21-389168763-3466295262-423288256-1002_Classes\CLSID\{E9C07CEC-7B82-49E4-BBA2-7533B88E9D64}\InprocServer32 -> axdb.dll => No File
CustomCLSID: HKU\S-1-5-21-389168763-3466295262-423288256-1002_Classes\CLSID\{EA34A0C0-5CE7-4701-A6FA-117D25CD5EBB}\InprocServer32 -> axdb.dll => No File
CustomCLSID: HKU\S-1-5-21-389168763-3466295262-423288256-1002_Classes\CLSID\{EF01D98A-747B-4522-AD70-991B90855DBF}\InprocServer32 -> axdb.dll => No File
CustomCLSID: HKU\S-1-5-21-389168763-3466295262-423288256-1002_Classes\CLSID\{DE74F5AD-DA2F-429F-BAF9-850A2808D585}\InprocServer32 -> axdb.dll => No File
CustomCLSID: HKU\S-1-5-21-389168763-3466295262-423288256-1002_Classes\CLSID\{DF6525C2-6358-4B07-813D-708120C5FE1A}\InprocServer32 -> axdb.dll => No File
CustomCLSID: HKU\S-1-5-21-389168763-3466295262-423288256-1002_Classes\CLSID\{E177A457-9EAA-43C3-A3CE-84874A28F6CA}\InprocServer32 -> axdb.dll => No File
ShortcutWithArgument: C:\Users\Paula\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T <==== ATTENTION
ShortcutWithArgument: C:\Users\Paula\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Autodesk\Zainstaluj teraz dla programu Autodesk® AutoCAD® 2016.lnk -> C:\Autodesk\AutoCAD_2016_Polish_Win_32_64bit_wi_pl-PL\Setup.exe (Autodesk, Inc.) -> /URL "hxxp://trial2.autodesk.com/NET16SWDLD/2016/ACD/WI/AutoCAD_2016_Polish_Win_32_64bit_wi_pl-PL_Setup.exe" /Trial /akamai <==== ATTENTION
ShortcutWithArgument: C:\Users\Paula\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T <==== ATTENTION
ShortcutWithArgument: C:\Users\Paula\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T <==== ATTENTION
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T <==== ATTENTION
C:\Program Files (x86)\Picexa
CustomCLSID: HKU\S-1-5-21-389168763-3466295262-423288256-1002_Classes\CLSID\{0215A4C0-5431-4FD0-9B06-46589B5C4939}\InprocServer32 -> axdb.dll => No File
CustomCLSID: HKU\S-1-5-21-389168763-3466295262-423288256-1002_Classes\CLSID\{048ED0E0-12CF-4C0F-9FFA-947C2FBE8C8E}\InprocServer32 -> axdb.dll => No File
CustomCLSID: HKU\S-1-5-21-389168763-3466295262-423288256-1002_Classes\CLSID\{071339A1-1946-44B2-B63E-50459B15DB86}\InprocServer32 -> axdb.dll => No File
C:\Users\Paula\AppData\Roaming\TSv
C:\Program Files (x86)\SFK
C:\ProgramData\UWdMU
HKU\S-1-5-21-389168763-3466295262-423288256-1002\...\Run: [Akamai NetSession Interface] => "C:\Users\Paula\AppData\Local\Akamai\netsession_win.exe"
C:\Users\Paula\AppData\Local\Akamai\netsession_win.exe
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T&q={searchTerms}
HKU\S-1-5-21-389168763-3466295262-423288256-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://mystart.toshiba.com
HKU\S-1-5-21-389168763-3466295262-423288256-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://mystart.toshiba.com
HKU\S-1-5-21-389168763-3466295262-423288256-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T
HKU\S-1-5-21-389168763-3466295262-423288256-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T
HKU\S-1-5-21-389168763-3466295262-423288256-1002\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://mystart.toshiba.com
HKU\S-1-5-21-389168763-3466295262-423288256-1002\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://mystart.toshiba.com
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T&q={searchTerms}
SearchScopes: HKU\S-1-5-21-389168763-3466295262-423288256-1002 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T&q={searchTerms}
SearchScopes: HKU\S-1-5-21-389168763-3466295262-423288256-1002 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T&q={searchTerms}
SearchScopes: HKU\S-1-5-21-389168763-3466295262-423288256-1002 -> {CD000FCB-80BD-4986-BB4A-ED5B4B3C9600} URL =
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1447038945&z=48902565890e2048d1c9ce0g5z1z0m9e9c5b6qaq3e&from=cor&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T
FF NewTab: chrome://quick_start/content/index.html
FF SelectedSearchEngine: yoursites123
FF SearchPlugin: C:\Users\Paula\AppData\Roaming\Mozilla\Firefox\Profiles\9qlvlzyr.default\searchplugins\yoursites123.xml [2015-12-10]
FF HKLM-x32\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Users\Paula\AppData\Roaming\Mozilla\Firefox\Profiles\9qlvlzyr.default\extensions\defsearchp@gmail.com => not found
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\Paula\AppData\Roaming\Mozilla\Firefox\Profiles\9qlvlzyr.default\extensions\deskCutv2@gmail.com => not found
FF HKLM-x32\...\Firefox\Extensions: [default_newtabff@gmail.com] - C:\Users\Paula\AppData\Roaming\Mozilla\Firefox\Profiles\9qlvlzyr.default\extensions\default_newtabff@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [yahooprotected@gmail.com] - C:\Users\Paula\AppData\Roaming\Mozilla\Firefox\Profiles\9qlvlzyr.default\extensions\yahooprotected@gmail.com => not found
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.yoursites123.com/?type=sc&ts=1449657508&z=9147dd802f37118915c2e3egaz2z2t5q8wdm1w2e8b&from=ient07021&uid=TOSHIBAXMK5061GSYN_Y2SET1K0TXXY2SET1K0T
R2 IhPul; C:\Users\Paula\AppData\Roaming\TSv\TSvr.exe [580752 2015-12-08] (tsvr.com)
R2 PicexaService; C:\Program Files (x86)\Picexa\PicexaSvc.exe [731784 2015-12-09] (Taiwan Shui Mu Chih Ching Technology Limited)
R2 SSFK; C:\Program Files (x86)\SFK\SSFK.exe [170144 2015-11-27] (TODO: <公司名>)
R2 WdMan; C:\ProgramData\UWdMU\WdMan.exe [333312 2015-12-04] (TFuns LIMITED) [File not signed]
C:\Users\Public\Desktop\Picexa.lnk
2015-12-09 11:40 - 2015-12-09 11:40 - 00000000 ____D C:\Users\Paula\AppData\Roaming\Picexa Viewer
2015-12-09 11:40 - 2015-12-09 11:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picexa
2015-12-09 11:39 - 2015-12-10 20:45 - 00000000 ____D C:\Program Files (x86)\SFK
2015-12-09 11:39 - 2015-12-10 20:42 - 00000001 _____ C:\WINDOWS\SysWOW64\pl.html
2015-12-09 11:38 - 2015-12-09 11:39 - 00000000 ____D C:\ProgramData\UWdMU
2015-12-09 11:38 - 2015-12-09 11:38 - 00000000 ____D C:\Users\Paula\AppData\Roaming\TSv
2015-12-09 11:38 - 2015-12-09 11:38 - 00000000 ____D C:\ProgramData\4WdM4
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
EmptyTemp:

Plik zapisz pod nazwą [b]fixlist.txt[/b] i umieść obok FRST.exe
Uruchom [b]FRST[/b] i kliknij przycisk [b]Fix[/b] (NAPRAW).


----------------------
Jeśli będzie OK, to będziemy kończyć:
Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix (NAPRAW).
przez SHIFT+DEL usuń pozostały folder C:\FRST.


Jeśli natomiast problem nie zniknie, to przeinstalujesz przeglądarkę, na której to jeszcze będzie.
.
 
barto81
komentarz
komentarz

Dzieki za pomoc. Wszystko wróciło do normy.

 

Pozdrawiam

Wciąż szukasz rozwiązania problemu? Napisz teraz na forum!

Możesz zadać pytanie bez konieczności rejestracji - wystarczy, że wypełnisz formularz.

×
×
  • Dodaj nową pozycję...

Powiadomienie o plikach cookie

Strona wykorzystuje pliki cookies w celu prawidłowego świadczenia usług i wygody użytkowników. Warunki przechowywania i dostępu do plików cookies możesz zmienić w ustawieniach przeglądarki.