Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-10-2014 Ran by J at 2014-10-04 00:30:41 Run:1 Running from C:\Users\J\Desktop Loaded Profile: J (Available profiles: J) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: R1 {55685567-4840-4a91-962b-49a412e9485a}w64; C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}w64.sys [61112 2014-05-26] (StdLib) R1 {9edd0ea8-2819-47c2-8320-b007d5996f8a}w64; C:\Windows\System32\drivers\{9edd0ea8-2819-47c2-8320-b007d5996f8a}w64.sys [61112 2014-05-12] (StdLib) R2 IePluginService; C:\ProgramData\IePluginService\PluginService.exe [705136 2014-04-11] (Cherished Technololgy LIMITED) S3 BTATH_LWFLT; \SystemRoot\system32\DRIVERS\btath_lwflt.sys [X] S2 Update webget; "C:\Program Files (x86)\webget\updatewebget.exe" [X] S2 Util webget; "C:\Program Files (x86)\webget\bin\utilwebget.exe" [X] Task: {377AE4DD-966C-46D5-9A8D-9432F9A2A65D} - System32\Tasks\Omiga Plus RunAsStdUser => C:\Program Files (x86)\Omiga Plus\omigaplus.exe Task: {6289A9F2-F219-4B27-88D1-EE056FC43CA5} - \AutoKMS No Task File <==== ATTENTION Task: {BE25E737-C552-4195-B62E-7C7DFAC0456F} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Adobe ARM] => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" HKU\S-1-5-21-1890577046-1904970765-735041783-1001\...\Run: [ALLUpdate] => "C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe" "sleep" ShortcutWithArgument: C:\Users\J\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=sc&from=wpm0226&uid=HitachiXHTS547550A9E384_J1120021CEPLRACEPLRAX&ts=1393568236 ShortcutWithArgument: C:\Users\J\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.delta-homes.com/?type=sc&ts=1388677535&from=wpm0102&uid=HitachiXHTS547550A9E384_J1120021CEPLRACEPLRAX ShortcutWithArgument: C:\Users\J\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer (2).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=sc&from=wpm0226&uid=HitachiXHTS547550A9E384_J1120021CEPLRACEPLRAX&ts=1393568236 HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=HitachiXHTS547550A9E384_J1120021CEPLRACEPLRAX&ts=1393568236&type=default&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?type=ds&ts=1388677535&from=wpm0102&uid=HitachiXHTS547550A9E384_J1120021CEPLRACEPLRAX&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=HitachiXHTS547550A9E384_J1120021CEPLRACEPLRAX&ts=1393568236 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=HitachiXHTS547550A9E384_J1120021CEPLRACEPLRAX&ts=1393568236 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?type=ds&ts=1388677535&from=wpm0102&uid=HitachiXHTS547550A9E384_J1120021CEPLRACEPLRAX&q={searchTerms} SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388677535&from=wpm0102&uid=HitachiXHTS547550A9E384_J1120021CEPLRACEPLRAX&q={searchTerms} SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388677535&from=wpm0102&uid=HitachiXHTS547550A9E384_J1120021CEPLRACEPLRAX&q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388677535&from=wpm0102&uid=HitachiXHTS547550A9E384_J1120021CEPLRACEPLRAX&q={searchTerms} SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388677535&from=wpm0102&uid=HitachiXHTS547550A9E384_J1120021CEPLRACEPLRAX&q={searchTerms} SearchScopes: HKCU - DefaultScope {607D409B-3C06-4744-AA43-6650F770CB34} URL = SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = SearchScopes: HKCU - {607D409B-3C06-4744-AA43-6650F770CB34} URL = Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File C:\Program Files (x86)\Mobogenie C:\ProgramData\IePluginService C:\ProgramData\WPM C:\Users\J\AppData\Local\genienext C:\Windows\MultiKMS C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}w64.sys C:\Windows\System32\drivers\{9edd0ea8-2819-47c2-8320-b007d5996f8a}w64.sys EmptyTemp: ***************** Processes closed successfully. {55685567-4840-4a91-962b-49a412e9485a}w64 => Unable to stop service {55685567-4840-4a91-962b-49a412e9485a}w64 => Service deleted successfully. {9edd0ea8-2819-47c2-8320-b007d5996f8a}w64 => Unable to stop service {9edd0ea8-2819-47c2-8320-b007d5996f8a}w64 => Service deleted successfully. IePluginService => Service not found. BTATH_LWFLT => Service deleted successfully. Update webget => Service deleted successfully. Util webget => Service deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{377AE4DD-966C-46D5-9A8D-9432F9A2A65D}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{377AE4DD-966C-46D5-9A8D-9432F9A2A65D}" => Key deleted successfully. C:\Windows\System32\Tasks\Omiga Plus RunAsStdUser => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Omiga Plus RunAsStdUser" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{6289A9F2-F219-4B27-88D1-EE056FC43CA5}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6289A9F2-F219-4B27-88D1-EE056FC43CA5}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BE25E737-C552-4195-B62E-7C7DFAC0456F}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BE25E737-C552-4195-B62E-7C7DFAC0456F}" => Key deleted successfully. C:\Windows\System32\Tasks\Desk 365 RunAsStdUser => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Desk 365 RunAsStdUser" => Key deleted successfully. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => Value not found. HKU\S-1-5-21-1890577046-1904970765-735041783-1001\Software\Microsoft\Windows\CurrentVersion\Run\\ALLUpdate => value deleted successfully. C:\Users\J\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk => Shortcut argument was removed successfully. C:\Users\J\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk => Shortcut argument was removed successfully. C:\Users\J\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer (2).lnk => Shortcut argument was removed successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. "HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully. "HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. "HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key not found. "HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{607D409B-3C06-4744-AA43-6650F770CB34}" => Key deleted successfully. "HKCR\CLSID\{607D409B-3C06-4744-AA43-6650F770CB34}" => Key not found. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} => value deleted successfully. "HKCR\CLSID\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}" => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => value deleted successfully. "HKCR\CLSID\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F}" => Key not found. C:\Program Files (x86)\Mobogenie => Moved successfully. C:\ProgramData\IePluginService => Moved successfully. C:\ProgramData\WPM => Moved successfully. C:\Users\J\AppData\Local\genienext => Moved successfully. C:\Windows\MultiKMS => Moved successfully. C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}w64.sys => Moved successfully. C:\Windows\System32\drivers\{9edd0ea8-2819-47c2-8320-b007d5996f8a}w64.sys => Moved successfully. EmptyTemp: => Removed 32.9 MB temporary data. The system needed a reboot. ==== End of Fixlog ====