Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 22-01-2014 Ran by Dell at 2014-01-22 13:17:26 Run:1 Running from C:\Documents and Settings\Dell\Moje dokumenty\Pobieranie Boot Mode: Normal ============================================== Content of fixlist: ***************** HKLM\...\Run: [] - [x]HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gazeta.pl/0,0.html?sc=1HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://ie8.gazeta.pl/internet_explorer_8/0,0.html?ie=1HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://gazeta.pl/0,0.html?sc=1HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gazeta.pl/0,0.html?sc=1HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages =StartMenuInternet: IEXPLORE.EXE - iexplore.exeSearchScopes: HKCU - {C8321615-F85B-4D79-9C16-5C8802853866} URL = http://szukaj.gazeta.pl/portalSearch.do?s.si(navigation).navigationEnabled=true&s.sm.query={searchTerms}S2 wfcs; C:\Program Files\Windows Firewall Control\wfcs.exe [x]C:\Documents and Settings\All Users\Dane aplikacji\WPMC:\Documents and Settings\Dell\.androidC:\Documents and Settings\Dell\daemonprocess.txtC:\Documents and Settings\Dell\Ustawienia lokalne\Dane aplikacji\cacheC:\Documents and Settings\Dell\Ustawienia lokalne\Dane aplikacji\genienextC:\Documents and Settings\Dell\Ustawienia lokalne\Dane aplikacji\MobogenieC:\Documents and Settings\Dell\Moje dokumenty\MobogenieC:\Documents and Settings\LocalService\Dane aplikacji\GeekBuddyRSPReg: reg delete "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{490A9E9B-DEEF-4A42-8A73-7AB5EAEABF77}" /fReg: reg delete "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{755668BE-AE1B-4159-8927-17FF4B1E8BD7}" /fCMD: copy "C:\Documents and Settings\Dell\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Preferences" "C:\Documents and Settings\Dell\Pulpit" ***************** ========= HKLM\...\Run: [] - [x]HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gazeta.pl/0,0.html?sc=1HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://ie8.gazeta.pl/internet_explorer_8/0,0.html?ie=1HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://gazeta.pl/0,0.html?sc=1HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gazeta.pl/0,0.html?sc=1HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages =StartMenuInternet: IEXPLORE.EXE - iexplore.exeSearchScopes: HKCU - {C8321615-F85B-4D79-9C16-5C8802853866} URL = http://szukaj.gazeta.pl/portalSearch.do?s.si(navigation).navigationEnabled=true&s.sm.query={searchTerms}S2 wfcs; C:\Program Files\Windows Firewall Control\wfcs.exe [x]C:\Documents and Settings\All Users\Dane aplikacji\WPMC:\Documents and Settings\Dell\.androidC:\Documents and Settings\Dell\daemonprocess.txtC:\Documents and Settings\Dell\Ustawienia lokalne\Dane aplikacji\cacheC:\Documents and Settings\Dell\Ustawienia lokalne\Dane aplikacji\genienextC:\Documents and Settings\Dell\Ustawienia lokalne\Dane aplikacji\MobogenieC:\Documents and Settings\Dell\Moje dokumenty\MobogenieC:\Documents and Settings\LocalService\Dane aplikacji\GeekBuddyRSPReg: reg delete "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{490A9E9B-DEEF-4A42-8A73-7AB5EAEABF77}" /fReg: reg delete "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{755668BE-AE1B-4159-8927-17FF4B1E8BD7}" /f copy "C:\Documents and Settings\Dell\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Preferences" "C:\Documents and Settings\Dell\Pulpit" ========= ========= End of CMD: ========= HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Secondary Start Pages => Value not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\HKLM\...\Run: [] - [x]HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gazeta.pl/0,0.html?sc=1HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://ie8.gazeta.pl/internet_explorer_8/0,0.html?ie=1HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://gazeta.pl/0,0.html?sc=1HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gazeta.pl/0,0.html?sc=1HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages =StartMenuInternet: IEXPLORE.EXE - iexplore.exe{C8321615-F85B-4D79-9C16-5C8802853866} => Key not found. HKCR\Wow6432Node\CLSID\HKLM\...\Run: [] - [x]HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gazeta.pl/0,0.html?sc=1HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://ie8.gazeta.pl/internet_explorer_8/0,0.html?ie=1HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://gazeta.pl/0,0.html?sc=1HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gazeta.pl/0,0.html?sc=1HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages =StartMenuInternet: IEXPLORE.EXE - iexplore.exe{C8321615-F85B-4D79-9C16-5C8802853866} => Key not found. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. HKLM\...\Run: [] - [x]HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gazeta.pl/0,0.html?sc=1HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://ie8.gazeta.pl/internet_explorer_8/0,0.html?ie=1HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://gazeta.pl/0,0.html?sc=1HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gazeta.pl/0,0.html?sc=1HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages =StartMenuInternet: IEXPLORE.EXE - iexplore.exeSearchScopes: HKCU - {C8321615-F85B-4D79-9C16-5C8802853866} URL = http://szukaj.gazeta.pl/portalSearch.do?s.si(navigation).navigationEnabled=true&s.sm.query={searchTerms}wfcs => Service not found. ========= HKLM\...\Run: [] - [x]HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gazeta.pl/0,0.html?sc=1HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://ie8.gazeta.pl/internet_explorer_8/0,0.html?ie=1HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://gazeta.pl/0,0.html?sc=1HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gazeta.pl/0,0.html?sc=1HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages =StartMenuInternet: IEXPLORE.EXE - iexplore.exeSearchScopes: HKCU - {C8321615-F85B-4D79-9C16-5C8802853866} URL = http://szukaj.gazeta.pl/portalSearch.do?s.si(navigation).navigationEnabled=true&s.sm.query={searchTerms}S2 wfcs; C:\Program Files\Windows Firewall Control\wfcs.exe [x]C:\Documents and Settings\All Users\Dane aplikacji\WPMC:\Documents and Settings\Dell\.androidC:\Documents and Settings\Dell\daemonprocess.txtC:\Documents and Settings\Dell\Ustawienia lokalne\Dane aplikacji\cacheC:\Documents and Settings\Dell\Ustawienia lokalne\Dane aplikacji\genienextC:\Documents and Settings\Dell\Ustawienia lokalne\Dane aplikacji\MobogenieC:\Documents and Settings\Dell\Moje dokumenty\MobogenieC:\Documents and Settings\LocalService\Dane aplikacji\GeekBuddyRSPreg delete "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{490A9E9B-DEEF-4A42-8A73-7AB5EAEABF77}" /fReg: reg delete "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{755668BE-AE1B-4159-8927-17FF4B1E8BD7}" /fCMD: copy "C:\Documents and Settings\Dell\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Preferences" "C:\Documents and Settings\Dell\Pulpit" ========= ========= End of Reg: ========= ==== End of Fixlog ====