Občasné vyskakování OMNIBOXES v Internet Exloreru 11

[kostik123456]

Prosím o pomoc,občas mi začalo vyskakovat OMNIBOXES pri otevření Internet Exploreru jako domovská stránka i když mám nastavený google.cz.Včera jsem měl zo 300 PUP v Chroomu a Mozille,ale to se mi podařilo odstranit z MalwareBytes Antimalware a AdwareCleanerem a následném proinstalování obou prohlížečů jen v tom Exploreru to stále není ono.Co z tím prosím?Vopřed moc děkuji za pomoc.
Posílám FRST log v příloze.Když bude třeba RSIT nebo nějakej jinej pošlu,díky moc.

Jo,málem jsem zapomněl,ješte se mi znova objevili ti viry SECOH-QAD.exe a SECOH-QAD.dll v systémové složce Windows.

[Rudy]

Zdravím!
Spusťte tuto utilitu:

Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.

[kostik123456]

Nic,všechno OK.Prosím rudy posílám ještě jeden screen,nebo nevím co to je zda to mohu vymazat nebo ne a co z tím SECOH-QAD.exe a SECOH-QAD.dll v systémové složce Windows?Nechápu proč se to tam stále objevuje i po vymazání.

log AdwCleaner -

# AdwCleaner v4.111 - Logfile created 08/03/2015 at 17:25:47
# Updated 18/02/2015 by Xplode
# Database : 2015-03-05.1 [Server]
# Operating system : Windows 8.1 Pro (x64)
# Username : KostíkaIrenka - KOSTIK-HP
# Running from : C:\Users\KostíkaIrenka\Desktop\adwcleaner_4.111.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v36.0.1 (x86 cs)


-\\ Google Chrome v41.0.2272.76

*************************

AdwCleaner[R96].txt - [651 bytes] - [08/03/2015 17:25:47]

########## EOF - C:\AdwCleaner\AdwCleaner[R96].txt - [710 bytes] ##########

[Rudy]

Vymazat nelze, patří to k aktualizcím. Otevřte poznámkový blok a zkopírujte do něj:

Start
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\...\Run: [] => [X]
HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\...\MountPoints2: {39386d12-a400-11e4-825f-b4b52f784602} - "J:\Autorun.exe"
HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\...\MountPoints2: {39386d2d-a400-11e4-825f-b4b52f784602} - "J:\Autorun.exe"
HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\...\MountPoints2: {66c63cdd-aafc-11e4-826a-b4b52f784602} - "G:\Autorun.exe"
HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\...\MountPoints2: {cdbcd39e-a51e-11e4-8266-b4b52f784602} - "G:\Autorun.exe"
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1546239244-3224499863-3315362649-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.omniboxes.com/web/?utm_sourc ... earchTerms}
SearchScopes: HKU\S-1-5-21-1546239244-3224499863-3315362649-1001 -> {C5B5D13C-776C-4077-811E-BDC2767D7334} URL =
FF SelectedSearchEngine: omniboxes
CHR Extension: (Twoo Notifications) - C:\Users\KostíkaIrenka\AppData\Local\Google\Chrome\User Data\Default\Extensions\mggafhpkgkfebnjfbiefbbbicikgchlf [2015-03-08]
CHR Extension: (SpeakIt!) - C:\Users\KostíkaIrenka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgeolalilifpodheeocdmbhehgnkkbak [2015-03-08]
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
C:\WINDOWS\Tasks\WYJND.job
C:\WINDOWS\Tasks\HUQR.job
C:\WINDOWS\SECOH-QAD.exe
C:\WINDOWS\SECOH-QAD.dll
C:\WINDOWS\system32\ApnDatabase.xml
C:\Users\KostíkaIrenka\AppData\Roaming\HUQR
C:\Users\KostíkaIrenka\AppData\Roaming\WYJND
Task: C:\WINDOWS\Tasks\HUQR.job => C:\Users\Kostý˙kaIrenka\AppData\Roaming\HUQR.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\WYJND.job => C:\Users\Kostý˙kaIrenka\AppData\Roaming\WYJND.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:8CE646EE
AlternateDataStreams: C:\Users\KostíkaIrenka\OneDrive:ms-properties
AlternateDataStreams: C:\Users\KostíkaIrenka\SkyDrive:ms-properties
End

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

[kostik123456]

Tady je log -

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-03-2015 03
Ran by KostíkaIrenka at 2015-03-08 18:00:02 Run:1
Running from C:\Users\KostíkaIrenka\Desktop
Loaded Profiles: KostíkaIrenka (Available profiles: KostíkaIrenka)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\...\Run: [] => [X]
HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\...\MountPoints2: {39386d12-a400-11e4-825f-b4b52f784602} - "J:\Autorun.exe"
HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\...\MountPoints2: {39386d2d-a400-11e4-825f-b4b52f784602} - "J:\Autorun.exe"
HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\...\MountPoints2: {66c63cdd-aafc-11e4-826a-b4b52f784602} - "G:\Autorun.exe"
HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\...\MountPoints2: {cdbcd39e-a51e-11e4-8266-b4b52f784602} - "G:\Autorun.exe"
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1546239244-3224499863-3315362649-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.omniboxes.com/web/?utm_sourc ... default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1546239244-3224499863-3315362649-1001 -> {C5B5D13C-776C-4077-811E-BDC2767D7334} URL =
FF SelectedSearchEngine: omniboxes
CHR Extension: (Twoo Notifications) - C:\Users\KostíkaIrenka\AppData\Local\Google\Chrome\User Data\Default\Extensions\mggafhpkgkfebnjfbiefbbbicikgchlf [2015-03-08]
CHR Extension: (SpeakIt!) - C:\Users\KostíkaIrenka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgeolalilifpodheeocdmbhehgnkkbak [2015-03-08]
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
C:\WINDOWS\Tasks\WYJND.job
C:\WINDOWS\Tasks\HUQR.job
C:\WINDOWS\SECOH-QAD.exe
C:\WINDOWS\SECOH-QAD.dll
C:\WINDOWS\system32\ApnDatabase.xml
C:\Users\KostíkaIrenka\AppData\Roaming\HUQR
C:\Users\KostíkaIrenka\AppData\Roaming\WYJND
Task: C:\WINDOWS\Tasks\HUQR.job => C:\Users\Kostý˙kaIrenka\AppData\Roaming\HUQR.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\WYJND.job => C:\Users\Kostý˙kaIrenka\AppData\Roaming\WYJND.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:8CE646EE
AlternateDataStreams: C:\Users\KostíkaIrenka\OneDrive:ms-properties
AlternateDataStreams: C:\Users\KostíkaIrenka\SkyDrive:ms-properties
End
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\Software\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
"HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{39386d12-a400-11e4-825f-b4b52f784602}" => Key deleted successfully.
HKCR\CLSID\{39386d12-a400-11e4-825f-b4b52f784602} => Key not found.
"HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{39386d2d-a400-11e4-825f-b4b52f784602}" => Key deleted successfully.
HKCR\CLSID\{39386d2d-a400-11e4-825f-b4b52f784602} => Key not found.
"HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{66c63cdd-aafc-11e4-826a-b4b52f784602}" => Key deleted successfully.
HKCR\CLSID\{66c63cdd-aafc-11e4-826a-b4b52f784602} => Key not found.
"HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cdbcd39e-a51e-11e4-8266-b4b52f784602}" => Key deleted successfully.
HKCR\CLSID\{cdbcd39e-a51e-11e4-8266-b4b52f784602} => Key not found.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} => Key not found.
HKCR\CLSID\{012E1000-F331-11DB-8314-0800200C9A66} => Key not found.
HKU\S-1-5-21-1546239244-3224499863-3315362649-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C5B5D13C-776C-4077-811E-BDC2767D7334} => Key not found.
HKCR\CLSID\{C5B5D13C-776C-4077-811E-BDC2767D7334} => Key not found.
Firefox SelectedSearchEngine deleted successfully.
C:\Users\KostíkaIrenka\AppData\Local\Google\Chrome\User Data\Default\Extensions\mggafhpkgkfebnjfbiefbbbicikgchlf => Moved successfully.
C:\Users\KostíkaIrenka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgeolalilifpodheeocdmbhehgnkkbak => Moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => Moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => Moved successfully.
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA => Moved successfully.
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore => Moved successfully.
C:\WINDOWS\Tasks\WYJND.job => Moved successfully.
C:\WINDOWS\Tasks\HUQR.job => Moved successfully.
C:\WINDOWS\SECOH-QAD.exe => Moved successfully.
C:\WINDOWS\SECOH-QAD.dll => Moved successfully.
C:\WINDOWS\system32\ApnDatabase.xml => Moved successfully.
C:\Users\KostíkaIrenka\AppData\Roaming\HUQR => Moved successfully.
C:\Users\KostíkaIrenka\AppData\Roaming\WYJND => Moved successfully.
C:\WINDOWS\Tasks\HUQR.job not found.
C:\WINDOWS\Tasks\WYJND.job not found.
C:\ProgramData\Temp => ":8CE646EE" ADS removed successfully.
"C:\Users\KostíkaIrenka\OneDrive" => ":ms-properties" ADS not found.
"C:\Users\KostíkaIrenka\SkyDrive" => ":ms-properties" ADS not found.

==== End of Fixlog 18:00:03 ====

[Rudy]

Smazáno. Nastala nějaká změna?

[kostik123456]

Jo,moc vám děkuji rudy a omlouvám se za češtinu,jsem slovák žijící v ČR.Mějte se hezky,
NASHLE.

[Rudy]

To, nic, slovenština mi nevadí. Mám slovenskou manželku. Nemáte zač!