Omiga plus - jak usunąć?

Dla specjalistów Bezpieczeństwo
#1

Jak w temacie. Nawet nie wiem kiedy i w czym mi się to wśliznęło.

 

FRST: http://www.wklej.org/id/1608672/

Addition: http://www.wklej.org/id/1608676/

 

Z góry dzięki.

#2

Otwórz notatnik systemowy i wklej:

Task: {C96FA025-4BF7-4B35-8E2F-197F019A5A2B} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-574896031-444226462-3123381329-1000UA = C:\Users\Bartuś\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-03-25] (Facebook Inc.)
Task: {EABAA504-FF0A-4044-B207-6768E7C18C5F} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-574896031-444226462-3123381329-1000Core = C:\Users\Bartuś\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-03-25] (Facebook Inc.)
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-574896031-444226462-3123381329-1000Core.job = C:\Users\Bartu[\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-574896031-444226462-3123381329-1000UA.job = C:\Users\Bartu[\AppData\Local\Facebook\Update\FacebookUpdate.exe
AlternateDataStreams: C:\Windows:4959BCA12A6F5970
HKLM\...\Run: [RtHDVBg] = C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2012-12-02] (Realtek Semiconductor)
HKLM-x32\...\Run: [GrooveMonitor] = C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
AppInit_DLLs: c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll = c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll File Not Found
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hpppts=1421942471from=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hpppts=1421942471from=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=dsts=1421942444from=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDXq={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=dsts=1421942444from=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDXq={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hpppts=1421942471from=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hpppts=1421942471from=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDX
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=dsts=1421942444from=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDXq={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=dsts=1421942444from=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDXq={searchTerms}
HKU\S-1-5-21-574896031-444226462-3123381329-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=dsppts=1421942471from=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDXq={searchTerms}
HKU\S-1-5-21-574896031-444226462-3123381329-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hpppts=1421942471from=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDX
HKU\S-1-5-21-574896031-444226462-3123381329-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hpppts=1421942471from=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDX
HKU\S-1-5-21-574896031-444226462-3123381329-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=dsppts=1421942471from=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDXq={searchTerms}
SearchScopes: HKU\S-1-5-21-574896031-444226462-3123381329-1000 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=dsppts=1421942471from=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDXq={searchTerms}
SearchScopes: HKU\S-1-5-21-574896031-444226462-3123381329-1000 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://isearch.omiga-plus.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDXts=1421942523type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-574896031-444226462-3123381329-1000 - {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://isearch.omiga-plus.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDXts=1421942523type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-574896031-444226462-3123381329-1000 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=dsppts=1421942471from=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDXq={searchTerms}
SearchScopes: HKU\S-1-5-21-574896031-444226462-3123381329-1000 - {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://isearch.omiga-plus.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDXts=1421942523type=defaultq={searchTerms}
BHO-x32: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\XTab\SupTab.dll (Thinknice Co. Limited)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
FF SelectedSearchEngine: omiga-plus
FF Homepage: hxxp://isearch.omiga-plus.com/?type=hpppts=1421942471from=coruid=HitachiXHTS547564A9E384_J2180053HPTLYDHPTLYDX
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\omiga-plus.xml
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\Bartu\u015B\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll No File
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158896 2015-01-16] (XTab system)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [464384 2015-01-22] (SysTool PasSame LIMITED) [File not signed]
2015-01-22 17:02 - 2015-01-22 17:02 - 00000000 ____ D () C:\ProgramData\IHProtectUpDate
2015-01-22 17:02 - 2015-01-22 17:02 - 00000000 ____ D () C:\Program Files (x86)\XTab
2015-01-22 17:01 - 2015-01-22 17:01 - 00000000 ____ D () C:\ProgramData\WindowsMangerProtect
2015-01-22 17:00 - 2015-01-23 19:10 - 00000000 ____ D () C:\Users\Bartuś\AppData\Roaming\omiga-plus
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.

#3

Gra i buczy. Youtube nie działał, teraz też działa. Dzięki! :slight_smile:

#4

Skasuj folder C:\FRST