Mam problem z omniga plus. Raporty z FRST:
http://www.wklej.org/id/1629820/
http://www.wklej.org/id/1629821/
Odinstaluj Adobe Reader 9.4.7 - Polish,Adobe Reader 9.5.5 - Polish,SpyHunter 4.Otwórz notatnik systemowy i wklej:
CustomCLSID: HKU\S-1-5-21-1976467093-2475597812-576102286-1001_Classes\CLSID\{109E35E5-C095-489E-ACCC-C3D605D00502}\InprocServer32 - C:\Users\user\AppData\LocalLow\MyAshampoo\prxtbMyA0.dll No File
CustomCLSID: HKU\S-1-5-21-1976467093-2475597812-576102286-1001_Classes\CLSID\{66E8DCC7-97D2-4A89-8E08-D0610FF0878C}\InprocServer32 - C:\Users\user\AppData\Local\Conduit\Community Alerts\Alert.dll No File
CustomCLSID: HKU\S-1-5-21-1976467093-2475597812-576102286-1001_Classes\CLSID\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\InprocServer32 - C:\Users\user\AppData\LocalLow\MyAshampoo\prxtbMyA0.dll No File
Task: {3D8967F4-3286-46D6-B3E7-AADA0F44FD6E} - System32\Tasks\{03525443-0A25-489E-BB1C-17E2DA13F763} = pcalua.exe -a "C:\Users\user\AppData\Roaming\Enigma Software Group\sh_installer.exe" -c -r sh
Task: {DC1E1EB3-E8B9-48FE-98FC-A9DEBE88A0A4} - System32\Tasks\SpyHunter4Startup = C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe [2015-02-09] (Enigma Software Group USA, LLC.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hpppts=1422961574from=coruid=HitachiXHDT721032SLA360_STF207MT0HK1YB0HK1YBX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=dsts=1422961529from=coruid=HitachiXHDT721032SLA360_STF207MT0HK1YB0HK1YBXq={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=dsts=1422961529from=coruid=HitachiXHDT721032SLA360_STF207MT0HK1YB0HK1YBXq={searchTerms}
HKU\S-1-5-21-1976467093-2475597812-576102286-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=dsppts=1422961574from=coruid=HitachiXHDT721032SLA360_STF207MT0HK1YB0HK1YBXq={searchTerms}
URLSearchHook: HKLM - (No Name) - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - No File
URLSearchHook: HKLM - MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Users\user\AppData\LocalLow\MyAshampoo\prxtbMyA0.dll No File
SearchScopes: HKLM - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}SearchSource=4ctid=CT2475029
SearchScopes: HKLM - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685query={searchTerms}invocationType=tb50winampie7
SearchScopes: HKU\S-1-5-21-1976467093-2475597812-576102286-1001 - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://isearch.omiga-plus.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=HitachiXHDT721032SLA360_STF207MT0HK1YB0HK1YBXts=1422961592type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-1976467093-2475597812-576102286-1001 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://isearch.omiga-plus.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=HitachiXHDT721032SLA360_STF207MT0HK1YB0HK1YBXts=1422961592type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-1976467093-2475597812-576102286-1001 - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = http://isearch.omiga-plus.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=HitachiXHDT721032SLA360_STF207MT0HK1YB0HK1YBXts=1422961592type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-1976467093-2475597812-576102286-1001 - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://isearch.omiga-plus.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=HitachiXHDT721032SLA360_STF207MT0HK1YB0HK1YBXts=1422961592type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-1976467093-2475597812-576102286-1001 - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = http://isearch.omiga-plus.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=HitachiXHDT721032SLA360_STF207MT0HK1YB0HK1YBXts=1422961592type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-1976467093-2475597812-576102286-1001 - {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://isearch.omiga-plus.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=HitachiXHDT721032SLA360_STF207MT0HK1YB0HK1YBXts=1422961592type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-1976467093-2475597812-576102286-1001 - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = http://isearch.omiga-plus.com/web/?utm_source=butm_medium=corutm_campaign=install_ieutm_content=dsfrom=coruid=HitachiXHDT721032SLA360_STF207MT0HK1YB0HK1YBXts=1422961592type=defaultq={searchTerms}
BHO: MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Users\user\AppData\LocalLow\MyAshampoo\prxtbMyA0.dll No File
Toolbar: HKLM - No Name - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - No File
Toolbar: HKLM - MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Users\user\AppData\LocalLow\MyAshampoo\prxtbMyA0.dll No File
Toolbar: HKU\S-1-5-21-1976467093-2475597812-576102286-1001 - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKU\S-1-5-21-1976467093-2475597812-576102286-1001 - No Name - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No File
Toolbar: HKU\S-1-5-21-1976467093-2475597812-576102286-1001 - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKU\S-1-5-21-1976467093-2475597812-576102286-1001 - MyAshampoo Toolbar - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - C:\Users\user\AppData\LocalLow\MyAshampoo\prxtbMyA0.dll No File
FF DefaultSearchEngine: webssearches
FF DefaultSearchUrl: hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029SearchSource=3q={searchTerms}
FF SelectedSearchEngine: webssearches
FF Homepage: hxxp://isearch.omiga-plus.com/?type=hpppts=1422961574from=coruid=HitachiXHDT721032SLA360_STF207MT0HK1YB0HK1YBX
FF SearchPlugin: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\51au3iqw.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\51au3iqw.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\51au3iqw.default\searchplugins\omiga-plus.xml
FF SearchPlugin: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\51au3iqw.default\searchplugins\webssearches.xml
FF Extension: Conduit Engine - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\51au3iqw.default\Extensions\engine@conduit.com [2011-05-23]
FF Extension: FF Toolbar - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\51au3iqw.default\Extensions\fftoolbar2014@etech.com [2015-02-03]
FF Extension: No Name - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\51au3iqw.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}-trash [2010-08-27]
FF Extension: MyAshampoo - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\51au3iqw.default\Extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} [2015-01-28]
FF HKLM\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\51au3iqw.default\extensions\fftoolbar2014@etech.com
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [770944 2015-02-09] (Enigma Software Group USA, LLC.)
S2 IHProtect Service; C:\Program Files\XTab\ProtectService.exe [X]
S2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe -service [X]
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [19984 2015-02-09] ()
2015-02-09 11:42 - 2015-02-09 11:42 - 00001075 _____ () C:\Users\user\Desktop\SpyHunter.lnk
2015-02-09 11:42 - 2015-02-09 11:42 - 00000000 ____ D () C:\Users\user\AppData\Roaming\Enigma Software Group
2015-02-09 11:42 - 2015-02-09 11:42 - 00000000 ____ D () C:\sh4ldr
2015-02-09 11:41 - 2015-02-09 11:41 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\user\Downloads\sh-remover(1).exe
2015-02-09 11:41 - 2015-02-09 11:41 - 00019984 _____ () C:\Windows\system32\Drivers\EsgScanner.sys
2015-02-09 11:41 - 2015-02-09 11:41 - 00000000 ____ D () C:\Program Files\Enigma Software Group
2015-02-04 09:32 - 2015-02-04 09:32 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\user\Downloads\sh-remover.exe
2015-02-03 12:06 - 2015-02-04 10:51 - 00000000 ____ D () C:\ProgramData\WindowsMangerProtect
2015-02-03 12:06 - 2015-02-04 10:51 - 00000000 ____ D () C:\Program Files\XTab
2015-02-03 12:06 - 2015-02-03 12:11 - 00000000 ____ D () C:\Users\user\AppData\Roaming\omiga-plus
2015-02-03 12:06 - 2015-02-03 12:06 - 00000000 ____ D () C:\ProgramData\IHProtectUpDate
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.
Dzięki. Wygląda, że jest OK.
Skasuj folder C:\FRST