Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-09-2014 Ran by Sayuri at 2014-09-18 18:15:41 Run:2 Running from C:\Users\Sayuri\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: HKU\S-1-5-21-2176411516-3333787489-937677154-1001\...\Run: [CMD] => cmd.exe /c start http://extendedunlimited.org && exit <===== ATTENTION Task: {FC94AEA3-F260-43FB-80F3-A7474576FD81} - \AutoKMS No Task File <==== ATTENTION StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\omiga-plus.xml S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X] S2 hjlkfdajklfed3dfa; \??\C:\Program Files (x86)\SupTab\cfgdrv64.cfg [X] S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X] S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X] S1 MpKsl79e54222; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{39A6E709-9DF0-4A1E-832F-393F34B67496}\MpKsl79e54222.sys [X] C:\ProgramData\pkeimendennphbobgjmacnnkbglgfpkg C:\ProgramData\pcpgkhkhigppdedocfembbglnapkinoi C:\ProgramData\Temp C:\Users\Sayuri\AppData\Roaming\* C:\Users\Sayuri\Downloads\*(*).exe Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Uninstall C:" /f EmptyTemp: ***************** Processes closed successfully. HKU\S-1-5-21-2176411516-3333787489-937677154-1001\Software\Microsoft\Windows\CurrentVersion\Run\\CMD => value deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{FC94AEA3-F260-43FB-80F3-A7474576FD81}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FC94AEA3-F260-43FB-80F3-A7474576FD81}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS" => Key deleted successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. C:\Program Files (x86)\mozilla firefox\browser\searchplugins\omiga-plus.xml => Moved successfully. ew_hwusbdev => Service deleted successfully. hjlkfdajklfed3dfa => Service deleted successfully. huawei_cdcacm => Service deleted successfully. huawei_enumerator => Service deleted successfully. MpKsl79e54222 => Service deleted successfully. C:\ProgramData\pkeimendennphbobgjmacnnkbglgfpkg => Moved successfully. C:\ProgramData\pcpgkhkhigppdedocfembbglnapkinoi => Moved successfully. C:\ProgramData\Temp => Moved successfully. "C:\Users\Sayuri\AppData\Roaming\*" directory move: Could not move "C:\Users\Sayuri\AppData\Roaming\*" directory. => Scheduled to move on reboot. C:\Users\Sayuri\Downloads\*(*).exe => Moved successfully. ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Uninstall C:" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= EmptyTemp: => Removed 12.7 GB temporary data. => Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-09-18 18:17:41)<= "C:\Users\Sayuri\AppData\Roaming\*" => Directory could not move. ==== End of Fixlog ====