Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-12-2013 Ran by Filip at 2013-12-02 19:09:54 Run:1 Running from C:\Users\Filip\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** Task: {2AC38E4A-A370-40AD-83B7-37BCEF08C68C} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv => C:\Windows\TEMP\{0AC0BF0E-0DED-4760-9C65-E7CE82CB48CE}.exe C:\Windows\TEMP\{0AC0BF0E-0DED-4760-9C65-E7CE82CB48CE}.exe Task: {81542EFF-2C5B-4AFB-B303-3C104E72357A} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1855460468-3222377162-2898529075-1000Core => C:\Users\Filip\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-26] (Facebook Inc.) C:\Users\Filip\AppData\Local\Facebook\Update Task: {BCA9BC77-E9D7-4F66-BF84-8CADE8C6A61C} - System32\Tasks\RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe C:\Program Files (x86)\Desk 365 Task: {C7244538-00E5-4A9B-A3D1-2DA980D9A3FA} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1855460468-3222377162-2898529075-1000UA => C:\Users\Filip\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-26] (Facebook Inc.) Task: {E189481D-A7D6-4782-B75A-5A60EBAABC71} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{88FA8008-2CEE-4F6C-8B62-A847FA896818}.exe ask: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job => C:\Windows\TEMP\{0AC0BF0E-0DED-4760-9C65-E7CE82CB48CE}.exe Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{88FA8008-2CEE-4F6C-8B62-A847FA896818}.exe Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1855460468-3222377162-2898529075-1000Core.job => C:\Users\Filip\AppData\Local\Facebook\Update\FacebookUpdate.exe Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1855460468-3222377162-2898529075-1000UA.job => C:\Users\Filip\AppData\Local\Facebook\Update\FacebookUpdate.exe C:\Users\Filip\AppData\Local\Facebook\Update C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\loader.dll C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.dll C:\Users\Filip\AppData\Local\Lollipop HKLM-x32\...\Runonce: [] - [x] HKCU\...\Run: [Facebook Update] - C:\Users\Filip\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-01-26] (Facebook Inc.) AppInit_DLLs: c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll c:\windows\system32\nvinitx.dll,c:\windows\system32\nvinitx.dll,c:\windows\system32\nvinitx.dll [ ] () c:\progra~3\bitguard Startup: C:\Users\Filip\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lollipop.lnk ShortcutTarget: lollipop.lnk -> C:\Users\Filip\AppData\Local\Lollipop\Lollipop.exe () HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.delta-se...119357&tsp=4978 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.22find.co...2&ts=1359824764 SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www1.delta-se...119357&tsp=4978 SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.22find...2&ts=1359824765 Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File CHR RestoreOnStartup: "hxxp://isearch.babylon.com/?babsrc=HP_ss_Btisdt4&mntrId=B68C742F6851E48C&affID=119357&tsp=4978" CHR DefaultSearchURL: (Delta Search) - http://www1.delta-se...119357&tsp=4978 CHR DefaultSuggestURL: (Delta Search) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter} CHR Extension: (DefaultTab) - C:\Users\Filip\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc\1.1.29_0 C:\Users\Filip\AppData\Roaming\OpenCandy C:\Users\Filip\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lollipop.lnk C:\Users\Filip\AppData\Local\Lollipop C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job C:\ProgramData\BitGuard C:\ProgramData\PKP_DLes.DAT C:\ProgramData\PKP_DLet.DAT C:\ProgramData\PKP_DLev.DAT C:\Users\Filip\AppData\Local\Temp\uninst1.exe C:\Users\Filip\AppData\Local\Temp\xfire_installer_10650.exe ***************** HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{2AC38E4A-A370-40AD-83B7-37BCEF08C68C} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2AC38E4A-A370-40AD-83B7-37BCEF08C68C} => Key deleted successfully. C:\Windows\System32\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AVG-Secure-Search-Update_JUNE2013_HP_rmv => Key deleted successfully. "C:\Windows\TEMP\{0AC0BF0E-0DED-4760-9C65-E7CE82CB48CE}.exe" => File/Directory not found. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{81542EFF-2C5B-4AFB-B303-3C104E72357A} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{81542EFF-2C5B-4AFB-B303-3C104E72357A} => Key deleted successfully. C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1855460468-3222377162-2898529075-1000Core => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\FacebookUpdateTaskUserS-1-5-21-1855460468-3222377162-2898529075-1000Core => Key deleted successfully. C:\Users\Filip\AppData\Local\Facebook\Update => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BCA9BC77-E9D7-4F66-BF84-8CADE8C6A61C} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BCA9BC77-E9D7-4F66-BF84-8CADE8C6A61C} => Key deleted successfully. C:\Windows\System32\Tasks\RunAsStdUser => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RunAsStdUser => Key deleted successfully. "C:\Program Files (x86)\Desk 365" => File/Directory not found. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C7244538-00E5-4A9B-A3D1-2DA980D9A3FA} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C7244538-00E5-4A9B-A3D1-2DA980D9A3FA} => Key deleted successfully. C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1855460468-3222377162-2898529075-1000UA => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\FacebookUpdateTaskUserS-1-5-21-1855460468-3222377162-2898529075-1000UA => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{E189481D-A7D6-4782-B75A-5A60EBAABC71} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E189481D-A7D6-4782-B75A-5A60EBAABC71} => Key deleted successfully. C:\Windows\System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AVG-Secure-Search-Update_JUNE2013_TB_rmv => Key deleted successfully. C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => Moved successfully. C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1855460468-3222377162-2898529075-1000Core.job => Moved successfully. C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1855460468-3222377162-2898529075-1000UA.job => Moved successfully. "C:\Users\Filip\AppData\Local\Facebook\Update" => File/Directory not found. "C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\loader.dll" => File/Directory not found. "C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.dll" => File/Directory not found. "C:\Users\Filip\AppData\Local\Lollipop" => File/Directory not found. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\ => Value not found. HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Facebook Update => Value deleted successfully. HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully. "c:\progra~3\bitguard" => File/Directory not found. C:\Users\Filip\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lollipop.lnk not found. C:\Users\Filip\AppData\Local\Lollipop\Lollipop.exe not found. HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key not found. HKCR\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Value deleted successfully. HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Value deleted successfully. HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Key not found. CHR RestoreOnStartup: "hxxp://isearch.babylon.com/?babsrc=HP_ss_Btisdt4&mntrId=B68C742F6851E48C&affID=119357&tsp=4978" ==> The Chrome "Settings" can be used to fix the entry. CHR DefaultSearchURL: (Delta Search) - http://www1.delta-se...119357&tsp=4978 ==> The Chrome "Settings" can be used to fix the entry. CHR DefaultSuggestURL: (Delta Search) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter} ==> The Chrome "Settings" can be used to fix the entry. C:\Users\Filip\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc directory not found. "C:\Users\Filip\AppData\Roaming\OpenCandy" => File/Directory not found. "C:\Users\Filip\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lollipop.lnk" => File/Directory not found. "C:\Users\Filip\AppData\Local\Lollipop" => File/Directory not found. C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job => Moved successfully. "C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job" => File/Directory not found. "C:\ProgramData\BitGuard" => File/Directory not found. C:\ProgramData\PKP_DLes.DAT => Moved successfully. C:\ProgramData\PKP_DLet.DAT => Moved successfully. C:\ProgramData\PKP_DLev.DAT => Moved successfully. C:\Users\Filip\AppData\Local\Temp\uninst1.exe => Moved successfully. C:\Users\Filip\AppData\Local\Temp\xfire_installer_10650.exe => Moved successfully. ==== End of Fixlog ====