Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-09-2014 Ran by oem at 2014-09-22 18:07:45 Run:1 Running from C:\Users\oem\Downloads Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [715656 2014-09-20] (Cherished Technololgy LIMITED) S2 mglupdate; C:\Program Files (x86)\Maxiget\Updater\MaxigetUpdater.exe [131480 2014-09-20] (Maxiget Ltd.) S3 mglupdatem; C:\Program Files (x86)\Maxiget\Updater\MaxigetUpdater.exe [131480 2014-09-20] (Maxiget Ltd.) U4 bdselfpr; No ImagePath Task: {6CAE0FE3-675F-4A3E-899A-DD91FCE7EC84} - System32\Tasks\MaxigetUpdaterTaskMachineUA => C:\Program Files (x86)\Maxiget\Updater\MaxigetUpdater.exe [2014-09-20] (Maxiget Ltd.) Task: {6DE9C3D4-419E-41CB-A800-DE356FC8DB7A} - System32\Tasks\MaxigetUpdaterTaskMachineCore => C:\Program Files (x86)\Maxiget\Updater\MaxigetUpdater.exe [2014-09-20] (Maxiget Ltd.) Task: C:\Windows\Tasks\MaxigetUpdaterTaskMachineCore.job => C:\Program Files (x86)\Maxiget\Updater\MaxigetUpdater.exe Task: C:\Windows\Tasks\MaxigetUpdaterTaskMachineUA.job => C:\Program Files (x86)\Maxiget\Updater\MaxigetUpdater.exe Winlogon\Notify\ScCertProp: wlnotify.dll [X] ShortcutWithArgument: C:\Users\oem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.istartsurf.com/?type=sc&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431 ShortcutWithArgument: C:\Users\oem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Users\oem\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.istartsurf.com/?type=sc&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431 ShortcutWithArgument: C:\Users\oem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.istartsurf.com/?type=sc&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431 ShortcutWithArgument: C:\Users\oem\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Users\oem\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.istartsurf.com/?type=sc&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431 ShortcutWithArgument: C:\Users\oem\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.istartsurf.com/?type=sc&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431 ShortcutWithArgument: C:\Users\oem\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk -> C:\Users\oem\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.istartsurf.com/?type=sc&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.istartsurf.com/?type=sc&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431 SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431&q={searchTerms} SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431&q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431&q={searchTerms} SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1411221593&from=epom2&uid=WDCXWD2500BEKT-60A25T1_WD-WXA1A50U0431U0431&q={searchTerms} BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited) CHR HKLM-x32\...\Chrome\Extension: [pelmeidfhdlhlbjimpabfcbnnojbboma] - C:\Users\oem\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx [2014-09-20] GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION FF Plugin-x32: @omaha.maxiget.com/Maxiget Updater;version=3 -> C:\Program Files (x86)\Maxiget\Updater\70.3.29.7018\npMaxigetUpdater3.dll (Maxiget Ltd.) FF Plugin-x32: @omaha.maxiget.com/Maxiget Updater;version=9 -> C:\Program Files (x86)\Maxiget\Updater\70.3.29.7018\npMaxigetUpdater3.dll (Maxiget Ltd.) FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird CustomCLSID: HKU\S-1-5-21-1402326780-2026060396-4273624969-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\oem\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File CustomCLSID: HKU\S-1-5-21-1402326780-2026060396-4273624969-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\oem\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File C:\Spacekace C:\Program Files\FileViewPro C:\Program Files\ESET C:\Program Files (x86)\Maxiget C:\Program Files (x86)\SupTab C:\Program Files (x86)\WinThruster C:\ProgramData\IePluginServices C:\Users\oem\AppData\Local\Maxiget C:\Users\oem\AppData\Roaming\ESET C:\Users\oem\AppData\Roaming\QuickScan C:\Users\oem\AppData\Roaming\Solvusoft C:\Windows\SysWOW64\GroupPolicy\GPT.INI EmptyTemp ***************** Processes closed successfully. IePluginServices => Service deleted successfully. mglupdate => Service deleted successfully. mglupdatem => Service deleted successfully. bdselfpr => Service deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6CAE0FE3-675F-4A3E-899A-DD91FCE7EC84}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6CAE0FE3-675F-4A3E-899A-DD91FCE7EC84}" => Key deleted successfully. C:\Windows\System32\Tasks\MaxigetUpdaterTaskMachineUA => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MaxigetUpdaterTaskMachineUA" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{6DE9C3D4-419E-41CB-A800-DE356FC8DB7A}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6DE9C3D4-419E-41CB-A800-DE356FC8DB7A}" => Key deleted successfully. C:\Windows\System32\Tasks\MaxigetUpdaterTaskMachineCore => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MaxigetUpdaterTaskMachineCore" => Key deleted successfully. C:\Windows\Tasks\MaxigetUpdaterTaskMachineCore.job => Moved successfully. C:\Windows\Tasks\MaxigetUpdaterTaskMachineUA.job => Moved successfully. "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp" => Key deleted successfully. C:\Users\oem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk => Shortcut argument was removed successfully. C:\Users\oem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk => Shortcut argument was removed successfully. C:\Users\oem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk => Shortcut argument was restored successfully. C:\Users\oem\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk => Shortcut argument was removed successfully. C:\Users\oem\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk => Shortcut argument was removed successfully. C:\Users\oem\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk => Shortcut argument was removed successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. "HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" => Key deleted successfully. "HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma" => Key deleted successfully. C:\Users\oem\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx => Moved successfully. C:\Windows\system32\GroupPolicy\Machine => Moved successfully. C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully. "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully. "HKLM\Software\Wow6432Node\MozillaPlugins\@omaha.maxiget.com/Maxiget Updater;version=3" => Key deleted successfully. C:\Program Files (x86)\Maxiget\Updater\70.3.29.7018\npMaxigetUpdater3.dll => Moved successfully. "HKLM\Software\Wow6432Node\MozillaPlugins\@omaha.maxiget.com/Maxiget Updater;version=9" => Key deleted successfully. C:\Program Files (x86)\Maxiget\Updater\70.3.29.7018\npMaxigetUpdater3.dll not found. HKLM\Software\Mozilla\Thunderbird\Extensions\\eplgTb@eset.com => value deleted successfully. HKLM\Software\Wow6432Node\Mozilla\Thunderbird\Extensions\\eplgTb@eset.com => value deleted successfully. "HKU\S-1-5-21-1402326780-2026060396-4273624969-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}" => Key deleted successfully. "HKU\S-1-5-21-1402326780-2026060396-4273624969-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}" => Key deleted successfully. C:\Spacekace => Moved successfully. C:\Program Files\FileViewPro => Moved successfully. C:\Program Files\ESET => Moved successfully. C:\Program Files (x86)\Maxiget => Moved successfully. C:\Program Files (x86)\SupTab => Moved successfully. C:\Program Files (x86)\WinThruster => Moved successfully. C:\ProgramData\IePluginServices => Moved successfully. C:\Users\oem\AppData\Local\Maxiget => Moved successfully. C:\Users\oem\AppData\Roaming\ESET => Moved successfully. C:\Users\oem\AppData\Roaming\QuickScan => Moved successfully. C:\Users\oem\AppData\Roaming\Solvusoft => Moved successfully. C:\Windows\SysWOW64\GroupPolicy\GPT.INI => Moved successfully. EmptyTemp => Error: No automatic fix found for this entry. The system needed a reboot. ==== End of Fixlog ====