-beatrix utworzono 25 grudnia 2015 utworzono 25 grudnia 2015 proszę o pomoc w usunięciu tego wirusa, jestem bardzo zielony w komputerach wiec jak mam zrobic te logi i co pobrac i wgl ? bardzo prosze o pomoc, uzywam Mozilli ale na chromei explorerze tez mam tego wirusa. aha i pytanie czy przez tego wirusa mogę miec skoki pingu ?
Twój_Anioł_Stróż komentarz 25 grudnia 2015 komentarz 25 grudnia 2015 1) Użyj >[url=http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner][b][color=blue]Adw-cleaner[/color][/b][/url] najpierw kliknij na SZUKAJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ (CLEANING), to kliknij na niego. Pokaż raport z niego "C" 2) Zrób logi z [b]FRST[/b] > http://www.forumpc.pl/topic/277786-nieingerencyjne-narz%C4%99dzia-do-tworzenia-log%C3%B3w-systemowych/?p=2010191 przed skanem zaznacz: Additional.txt .
Twój_Anioł_Stróż komentarz 25 grudnia 2015 komentarz 25 grudnia 2015 (edytowane) 1) Odinstaluj te programy: RapidReader 1.10.0.24 (HKLM\...\RapidReader_1.10.0.24) (Version: 1.10.0.24 - RapidReader) <==== UWAGA WinZipper (HKLM\...\WinZipper) (Version: 1.5.130 - Taiwan Shui Mu Chih Ching Technology Limited.) <==== UWAGA 2) Otwórz Notatnik i wklej w nim: DeleteKey: HKLM\SOFTWARE\Wow6432Node\yoursites123Software ShortcutWithArgument: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1450081401&z=40c3a276576605f990ec100gcz2waedeabag3zeece&from=wpm07173&uid=395049983_397234_C4049EBF ShortcutWithArgument: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1450081401&z=40c3a276576605f990ec100gcz2waedeabag3zeece&from=wpm07173&uid=395049983_397234_C4049EBF ShortcutWithArgument: C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1450081401&z=40c3a276576605f990ec100gcz2waedeabag3zeece&from=wpm07173&uid=395049983_397234_C4049EBF ShortcutWithArgument: C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1450081401&z=40c3a276576605f990ec100gcz2waedeabag3zeece&from=wpm07173&uid=395049983_397234_C4049EBF ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1450081401&z=40c3a276576605f990ec100gcz2waedeabag3zeece&from=wpm07173&uid=395049983_397234_C4049EBF ShortcutWithArgument: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1450784344&z=b3eae5cae1e1226377face5gdzdw8e5mdb6z1c1z5z&from=wpm07173&uid=395049983_397234_C4049EBF 2015-11-22 19:25 - 2015-12-22 12:39 - 0000074 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat 2015-12-14 09:23 - 2015-11-22 19:25 - 00000000 ____D C:\ProgramData\1WMiniPro1 2015-12-22 12:39 - 2015-10-13 16:29 - 00000000 ____D C:\Program Files\RayDld 2015-12-25 11:02 - 2015-12-25 11:02 - 00000001 _____ C:\Windows\system32\pl.html 2015-12-22 12:40 - 2015-12-25 11:04 - 00000000 ____D C:\Program Files\WinZipper 2015-12-22 12:39 - 2015-12-24 21:30 - 00000000 ____D C:\Program Files\SFK 2015-12-22 12:39 - 2015-12-22 12:40 - 00000000 ____D C:\ProgramData\ZWdMZ 2015-12-22 12:39 - 2015-12-22 12:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\TSv 2015-12-14 09:25 - 2015-12-14 09:25 - 00000000 ____D C:\Users\Admin\AppData\Roaming\WinZipper 2015-12-14 09:25 - 2015-12-14 09:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper 2015-12-14 09:24 - 2015-12-14 09:25 - 00000000 ____D C:\ProgramData\HWdMH 2015-12-14 09:23 - 2015-12-14 09:24 - 00000000 ____D C:\ProgramData\2WdM2 R2 winzipersvc; C:\Program Files\WinZipper\winzipersvc.exe [711344 2015-12-14] (Taiwan Shui Mu Chih Ching Technology Limited) <==== UWAGA R2 WdMan; C:\ProgramData\ZWdMZ\WdMan.exe [333312 2015-12-04] (TFuns LIMITED) [Brak podpisu cyfrowego] R2 ihpmServer; C:\Program Files\RayDld\ihpmServer.exe [265960 2015-12-22] (RayDl) R2 IhPul; C:\Users\Admin\AppData\Roaming\TSv\TSvr.exe [580752 2015-12-08] (tsvr.com) FF HKLM\...\Firefox\Extensions: [default_newtabff@gmail.com] - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uppihvpq.default-1450202891970\extensions\default_newtabff@gmail.com => nie znaleziono FF HKLM\...\Firefox\Extensions: [yahooprotected@gmail.com] - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jfs1jku5.default\extensions\yahooprotected@gmail.com => nie znaleziono StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla Firefox\firefox.exe hxxp://www.yoursites123.com/?type=sc&ts=1450784344&z=b3eae5cae1e1226377face5gdzdw8e5mdb6z1c1z5z&from=wpm07173&uid=395049983_397234_C4049EBF FF HKLM\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jfs1jku5.default\extensions\deskCutv2@gmail.com => nie znaleziono FF HKLM\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jfs1jku5.default\extensions\defsearchp@gmail.com => nie znaleziono FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uppihvpq.default-1450202891970\searchplugins\yoursites123.xml [2015-12-22] FF NewTab: hxxp://www.yoursites123.com/newtab/?type=nt&ts=1450784344&z=b3eae5cae1e1226377face5gdzdw8e5mdb6z1c1z5z&from=wpm07173&uid=395049983_397234_C4049EBF FF DefaultSearchEngine: yoursites123 StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1448216633&z=7331c9d4ccdee9d6aec9b12g1z0z6bdo0gfq9c2g9w&from=cornl&uid=395049983_397234_C4049EBF BHO: Bronze Aid -> {a5bfd1d3-18b6-4fc3-b3f9-262ae3552dbe} -> C:\Program Files\Bronze Aid\Extensions\a5bfd1d3-18b6-4fc3-b3f9-262ae3552dbe.dll => Brak pliku HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1450081401&z=40c3a276576605f990ec100gcz2waedeabag3zeece&from=wpm07173&uid=395049983_397234_C4049EBF HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1450081401&z=40c3a276576605f990ec100gcz2waedeabag3zeece&from=wpm07173&uid=395049983_397234_C4049EBF&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1450081401&z=40c3a276576605f990ec100gcz2waedeabag3zeece&from=wpm07173&uid=395049983_397234_C4049EBF HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1450081401&z=40c3a276576605f990ec100gcz2waedeabag3zeece&from=wpm07173&uid=395049983_397234_C4049EBF&q={searchTerms} HKU\S-1-5-21-17657668-3543987597-1045286620-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1450081401&z=40c3a276576605f990ec100gcz2waedeabag3zeece&from=wpm07173&uid=395049983_397234_C4049EBF&q={searchTerms} HKU\S-1-5-21-17657668-3543987597-1045286620-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1450081401&z=40c3a276576605f990ec100gcz2waedeabag3zeece&from=wpm07173&uid=395049983_397234_C4049EBF HKU\S-1-5-21-17657668-3543987597-1045286620-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1450081401&z=40c3a276576605f990ec100gcz2waedeabag3zeece&from=wpm07173&uid=395049983_397234_C4049EBF HKU\S-1-5-21-17657668-3543987597-1045286620-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1450081401&z=40c3a276576605f990ec100gcz2waedeabag3zeece&from=wpm07173&uid=395049983_397234_C4049EBF&q={searchTerms} C:\Program Files\WinZipper C:\Windows\Minidump\*.dmp EmptyTemp: Plik zapisz pod nazwą [b]fixlist.txt[/b] i umieść obok FRST.exe Uruchom [b]FRST[/b] i kliknij przycisk [b]Fix[/b] (NAPRAW). ---------------------- Jeśli będzie OK, to będziemy kończyć: Otwórz Notatnik i wklej w nim: DeleteQuarantine: Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix (NAPRAW). przez SHIFT+DEL usuń pozostały folder C:\FRST. W Adw-Cleaner kliknij na przycisk [b]Odinstaluj[/b] ([b]UNINSTALL[/b]). Jeśli natomiast problem nie zniknie, to przeinstalujesz przeglądarkę, na której to jeszcze będzie. .
Wciąż szukasz rozwiązania problemu? Napisz teraz na forum!
Możesz zadać pytanie bez konieczności rejestracji - wystarczy, że wypełnisz formularz.