Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 09-03-2014 01 Ran by admin at 2014-03-10 07:32:31 Run:1 Running from C:\Documents and Settings\admin\Moje dokumenty\Pobieranie Boot Mode: Normal ============================================== Content of fixlist: ***************** Task: C:\WINDOWS\Tasks\AmiUpdXp.job => C:\Documents and Settings\admin\Dane aplikacji\13038\a12358.exe <==== ATTENTION HKLM\...\Run: [KernelFaultCheck] - %systemroot%\system32\dumprep 0 -k HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.awesomehp.com/?type=hp&ts=1394368732&from=amt&uid=ST3808110AS_5LR4DKQKXXXX5LR4DKQK HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.awesomehp.com/?type=hp&ts=1394368732&from=amt&uid=ST3808110AS_5LR4DKQKXXXX5LR4DKQK HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.awesomehp.com/?type=hp&ts=1394368732&from=amt&uid=ST3808110AS_5LR4DKQKXXXX5LR4DKQK HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.awesomehp.com/web/?type=ds&ts=1394368732&from=amt&uid=ST3808110AS_5LR4DKQKXXXX5LR4DKQK&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.awesomehp.com/web/?type=ds&ts=1394368732&from=amt&uid=ST3808110AS_5LR4DKQKXXXX5LR4DKQK&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.awesomehp.com/?type=hp&ts=1394368732&from=amt&uid=ST3808110AS_5LR4DKQKXXXX5LR4DKQK StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.awesomehp.com/?type=sc&ts=1394368732&from=amt&uid=ST3808110AS_5LR4DKQKXXXX5LR4DKQK SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.awesomehp.com/web/?type=ds&ts=1394368732&from=amt&uid=ST3808110AS_5LR4DKQKXXXX5LR4DKQK&q={searchTerms} SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.awesomehp.com/web/?type=ds&ts=1394368732&from=amt&uid=ST3808110AS_5LR4DKQKXXXX5LR4DKQK&q={searchTerms} SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_uid=EAF864AB-1247-49DE-BE9F-C6D68D196AA1&apn_sauid=248275AC-BB0B-422B-AD5F-5D1DEA3A8EA5 SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.awesomehp.com/web/?type=ds&ts=1394368732&from=amt&uid=ST3808110AS_5LR4DKQKXXXX5LR4DKQK&q={searchTerms} BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files\SupTab\SupTab.dll (Thinknice Co. Limited) BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File BHO: IE5BarLauncherBHO Class - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files\StartSearch plugin\ssBarLcher.dll (StartSearch Inc.) BHO: Surftastic - {c6673938-a52b-4dc6-af05-783e7e2c8b65} - C:\Program Files\Surftastic\Surftasticbho.dll (Surftastic) Toolbar: HKLM - StartSearchToolBar - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files\StartSearch plugin\ssBarLcher.dll (StartSearch Inc.) Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Toolbar: HKCU - StartSearchToolBar - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files\StartSearch plugin\ssBarLcher.dll (StartSearch Inc.) Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File FF StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla Firefox\firefox.exe http://www.awesomehp.com/?type=sc&ts=1394368732&from=amt&uid=ST3808110AS_5LR4DKQKXXXX5LR4DKQK FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird R2 Update Surftastic; C:\Program Files\Surftastic\updateSurftastic.exe [111904 2014-03-07] () R2 Util Surftastic; C:\Program Files\Surftastic\bin\utilSurftastic.exe [111904 2014-03-09] () S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X] C:\Program Files\Enigma Software Group C:\Program Files\Mobogenie C:\Program Files\SupTab C:\Documents and Settings\All Users\Dane aplikacji\IePluginService C:\Documents and Settings\admin\Dane aplikacji\SupTab C:\Documents and Settings\admin\Ustawienia lokalne\Dane aplikacji\Lollipop C:\Program Files\Surftastic C:\Documents and Settings\admin\Dane aplikacji\13038 CMD: netsh winsock reset ***************** C:\WINDOWS\Tasks\AmiUpdXp.job => Moved successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\KernelFaultCheck => Value deleted successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} => Key deleted successfully. HKCR\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} => Key deleted successfully. HKCR\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} => Key not found. HKCR\CLSID\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} => Key not found. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c6673938-a52b-4dc6-af05-783e7e2c8b65} => Key deleted successfully. HKCR\CLSID\{c6673938-a52b-4dc6-af05-783e7e2c8b65} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} => Value not found. HKCR\CLSID\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} => Key not found. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} => Value deleted successfully. HKCR\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} => Key not found. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} => Value deleted successfully. HKCR\CLSID\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} => Key not found. HKCR\PROTOCOLS\Handler\linkscanner => Key deleted successfully. HKCR\CLSID\{F274614C-63F8-47D5-A4D1-FBDDE494F8D1} => Key not found. HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\\Default => Value was restored successfully. HKLM\Software\Mozilla\Thunderbird\Extensions\\eplgTb@eset.com => Value deleted successfully. Update Surftastic => Unable to stop service Update Surftastic => Service deleted successfully. Util Surftastic => Unable to stop service Util Surftastic => Service deleted successfully. esgiguard => Service deleted successfully. hwdatacard => Service deleted successfully. "C:\Program Files\Enigma Software Group" directory move: C:\Program Files\Enigma Software Group\SpyHunter\cos.dat => Moved successfully. C:\Program Files\Enigma Software Group\SpyHunter\gas.dat => Moved successfully. C:\Program Files\Enigma Software Group\SpyHunter\gil.dat => Moved successfully. C:\Program Files\Enigma Software Group\SpyHunter\INSTALL.LOG => Moved successfully. C:\Program Files\Enigma Software Group\SpyHunter\safeol.dat => Moved successfully. C:\Program Files\Enigma Software Group\SpyHunter\scanlog.log => Moved successfully. C:\Program Files\Enigma Software Group\SpyHunter\SH4.com => Moved successfully. C:\Program Files\Enigma Software Group\SpyHunter\supportlog.txt => Moved successfully. C:\Program Files\Enigma Software Group\SpyHunter\unkcache.dat => Moved successfully. C:\Program Files\Enigma Software Group\SpyHunter\mon\autoexec.bat.bk => Moved successfully. C:\Program Files\Enigma Software Group\SpyHunter\mon\hosts.bk => Moved successfully. C:\Program Files\Enigma Software Group\SpyHunter\mon\system.ini.bk => Moved successfully. C:\Program Files\Enigma Software Group\SpyHunter\mon\win.ini.bk => Moved successfully. C:\Program Files\Enigma Software Group\SpyHunter\Log\SpyHunter4_20140309_154702.log => Moved successfully. C:\Program Files\Enigma Software Group\SpyHunter\Defs\2014030701.def => Moved successfully. C:\Program Files\Enigma Software Group\SpyHunter\Data\dns.dat => Moved successfully. Could not move "C:\Program Files\Enigma Software Group" directory. => Scheduled to move on reboot. C:\Program Files\Mobogenie => Moved successfully. C:\Program Files\SupTab => Moved successfully. "C:\Documents and Settings\All Users\Dane aplikacji\IePluginService" directory move: C:\Documents and Settings\All Users\Dane aplikacji\IePluginService\update\conf => Moved successfully. Could not move "C:\Documents and Settings\All Users\Dane aplikacji\IePluginService" directory. => Scheduled to move on reboot. "C:\Documents and Settings\admin\Dane aplikacji\SupTab" directory move: C:\Documents and Settings\admin\Dane aplikacji\SupTab\SupTab.dll => Moved successfully. Could not move "C:\Documents and Settings\admin\Dane aplikacji\SupTab" directory. => Scheduled to move on reboot. "C:\Documents and Settings\admin\Ustawienia lokalne\Dane aplikacji\Lollipop" directory move: C:\Documents and Settings\admin\Ustawienia lokalne\Dane aplikacji\Lollipop\logo.ico => Moved successfully. C:\Documents and Settings\admin\Ustawienia lokalne\Dane aplikacji\Lollipop\lollipop.dat => Moved successfully. C:\Documents and Settings\admin\Ustawienia lokalne\Dane aplikacji\Lollipop\lollipop.lpd => Moved successfully. C:\Documents and Settings\admin\Ustawienia lokalne\Dane aplikacji\Lollipop\lollipop_cfg.lpd => Moved successfully. C:\Documents and Settings\admin\Ustawienia lokalne\Dane aplikacji\Lollipop\lollipop_ps.lpd => Moved successfully. Could not move "C:\Documents and Settings\admin\Ustawienia lokalne\Dane aplikacji\Lollipop" directory. => Scheduled to move on reboot. C:\Program Files\Surftastic => Moved successfully. C:\Documents and Settings\admin\Dane aplikacji\13038 => Moved successfully. ========= netsh winsock reset ========= Pomy˜lnie zresetowano Winsock Catalog. Musisz ponownie uruchomi† komputer, aby ukoäczy† resetowanie. ========= End of CMD: ========= => Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-03-10 07:37:41)<= C:\Program Files\Enigma Software Group => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\IePluginService => Moved successfully. C:\Documents and Settings\admin\Dane aplikacji\SupTab => Moved successfully. C:\Documents and Settings\admin\Ustawienia lokalne\Dane aplikacji\Lollipop => Moved successfully. ==== End of Fixlog ====