Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-10-2014 Ran by Bartek at 2014-10-23 22:20:48 Run:1 Running from C:\Users\Bartek\Desktop Loaded Profile: Bartek (Available profiles: Bartek) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [705416 2014-09-24] (Cherished Technololgy LIMITED) R2 Update AdvanceElite; C:\Program Files (x86)\AdvanceElite\updateAdvanceElite.exe [524016 2014-10-22] () R2 Update Framed Display; C:\Program Files (x86)\Framed Display\updateFramedDisplay.exe [524024 2014-10-23] () R2 Util AdvanceElite; C:\Program Files (x86)\AdvanceElite\bin\utilAdvanceElite.exe [523504 2014-10-23] () R2 Util Framed Display; C:\Program Files (x86)\Framed Display\bin\utilFramedDisplay.exe [524024 2014-10-23] () R1 {00aec75d-051f-41a9-9837-e94ac4f56303}Gw64; C:\Windows\System32\drivers\{00aec75d-051f-41a9-9837-e94ac4f56303}Gw64.sys [48784 2014-10-15] (StdLib) R1 {02bbe9df-d3b0-43f4-8dcb-e24500d3308f}Gw64; C:\Windows\System32\drivers\{02bbe9df-d3b0-43f4-8dcb-e24500d3308f}Gw64.sys [48784 2014-10-17] (StdLib) R1 {1de2a23f-1c23-4ea1-8ef4-79bc5c5cea78}Gw64; C:\Windows\System32\drivers\{1de2a23f-1c23-4ea1-8ef4-79bc5c5cea78}Gw64.sys [48784 2014-10-13] (StdLib) R1 {3b808196-ff63-49ee-b33b-efdf51723eca}Gw64; C:\Windows\System32\drivers\{3b808196-ff63-49ee-b33b-efdf51723eca}Gw64.sys [48784 2014-10-13] (StdLib) R1 {3fa44d1f-c300-4673-a8c1-5ba05468b4bd}Gw64; C:\Windows\System32\drivers\{3fa44d1f-c300-4673-a8c1-5ba05468b4bd}Gw64.sys [48784 2014-10-18] (StdLib) R1 {4096aedf-3f28-4c8e-aebe-00255138fa8a}Gw64; C:\Windows\System32\drivers\{4096aedf-3f28-4c8e-aebe-00255138fa8a}Gw64.sys [48784 2014-10-14] (StdLib) R1 {4530e639-76ab-4435-889d-a5e81ae090a4}Gw64; C:\Windows\System32\drivers\{4530e639-76ab-4435-889d-a5e81ae090a4}Gw64.sys [48784 2014-10-20] (StdLib) R1 {46a147d8-5171-42d8-b8a8-6a187525781d}Gw64; C:\Windows\System32\drivers\{46a147d8-5171-42d8-b8a8-6a187525781d}Gw64.sys [48784 2014-10-15] (StdLib) R1 {5d78e0ee-ca60-46a4-9492-4f24429cc925}Gw64; C:\Windows\System32\drivers\{5d78e0ee-ca60-46a4-9492-4f24429cc925}Gw64.sys [48784 2014-10-17] (StdLib) R1 {67f29abb-07b3-41f5-94cd-f819d7c1fc76}Gw64; C:\Windows\System32\drivers\{67f29abb-07b3-41f5-94cd-f819d7c1fc76}Gw64.sys [48784 2014-10-20] (StdLib) R1 {6c84eb28-66c4-4e3d-8a5a-46ab94f0575a}Gw64; C:\Windows\System32\drivers\{6c84eb28-66c4-4e3d-8a5a-46ab94f0575a}Gw64.sys [48784 2014-10-19] (StdLib) R1 {7012eec1-4f37-42d4-a2cd-26727494d248}Gw64; C:\Windows\System32\drivers\{7012eec1-4f37-42d4-a2cd-26727494d248}Gw64.sys [48792 2014-10-13] (StdLib) R1 {733fb217-c049-41ba-9504-3f2045e61977}Gw64; C:\Windows\System32\drivers\{733fb217-c049-41ba-9504-3f2045e61977}Gw64.sys [48784 2014-10-21] (StdLib) R1 {949aba83-1d7f-4d0b-b0ba-203450825231}Gw64; C:\Windows\System32\drivers\{949aba83-1d7f-4d0b-b0ba-203450825231}Gw64.sys [48784 2014-10-16] (StdLib) R1 {a6762132-8e80-4305-b1ba-2bec91757ac2}Gw64; C:\Windows\System32\drivers\{a6762132-8e80-4305-b1ba-2bec91757ac2}Gw64.sys [48792 2014-10-22] (StdLib) R1 {dc592624-f532-4311-9fc7-6920126fc404}Gw64; C:\Windows\System32\drivers\{dc592624-f532-4311-9fc7-6920126fc404}Gw64.sys [48784 2014-10-22] (StdLib) R1 {f5d136d7-adc2-4c84-85b2-e564334ab0bc}Gw64; C:\Windows\System32\drivers\{f5d136d7-adc2-4c84-85b2-e564334ab0bc}Gw64.sys [48784 2014-10-22] (StdLib) R1 {fce396ae-d8d1-4789-946e-2106fbe4292b}Gw64; C:\Windows\System32\drivers\{fce396ae-d8d1-4789-946e-2106fbe4292b}Gw64.sys [48784 2014-10-18] (StdLib) S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION CHR HomePage: Default -> hxxp://www.sweet-page.com/?type=hp&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2 CHR StartupUrls: Default -> "hxxp://www.sweet-page.com/?type=hp&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2" ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.sweet-page.com/?type=sc&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2 ShortcutWithArgument: C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.sweet-page.com/?type=sc&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2 ShortcutWithArgument: C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.sweet-page.com/?type=sc&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2 ShortcutWithArgument: C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.sweet-page.com/?type=sc&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2 ShortcutWithArgument: C:\Users\Bartek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.sweet-page.com/?type=sc&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2 ShortcutWithArgument: C:\Users\Bartek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.sweet-page.com/?type=sc&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2 ShortcutWithArgument: C:\Users\Bartek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.sweet-page.com/?type=sc&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp120141013 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp120141013 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.sweet-page.com/?type=sc&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2 SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms} SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms} SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms} SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms} SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms} BHO-x32: Framed Display -> {05b5ef3f-4c6a-426e-b77e-48ebb3e721f1} -> C:\Program Files (x86)\Framed Display\FramedDisplaybho.dll (Framed Display) BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited) BHO-x32: AdvanceElite -> {3b2cb4c8-72ab-4b25-8fa1-219b36a60bed} -> C:\Program Files (x86)\AdvanceElite\AdvanceElitebho.dll (AdvanceElite) Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File C:\Program Files\Enigma Software Group C:\Program Files (x86)\Optimizer Pro C:\Program Files (x86)\SupTab C:\ProgramData\374311380 C:\ProgramData\IePluginServices C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Preferences C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter C:\Users\Bartek\AppData\Roaming\SupTab C:\Users\Bartek\AppData\Roaming\Systweak C:\Users\Bartek\Documents\Optimizer Pro C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP C:\Windows\system32\roboot64.exe C:\Windows\System32\drivers\{00aec75d-051f-41a9-9837-e94ac4f56303}Gw64.sys C:\Windows\System32\drivers\{02bbe9df-d3b0-43f4-8dcb-e24500d3308f}Gw64.sys C:\Windows\System32\drivers\{1de2a23f-1c23-4ea1-8ef4-79bc5c5cea78}Gw64.sys C:\Windows\System32\drivers\{3b808196-ff63-49ee-b33b-efdf51723eca}Gw64.sys C:\Windows\System32\drivers\{3fa44d1f-c300-4673-a8c1-5ba05468b4bd}Gw64.sys C:\Windows\System32\drivers\{4096aedf-3f28-4c8e-aebe-00255138fa8a}Gw64.sys C:\Windows\System32\drivers\{4530e639-76ab-4435-889d-a5e81ae090a4}Gw64.sys C:\Windows\System32\drivers\{46a147d8-5171-42d8-b8a8-6a187525781d}Gw64.sys C:\Windows\System32\drivers\{5d78e0ee-ca60-46a4-9492-4f24429cc925}Gw64.sys C:\Windows\System32\drivers\{67f29abb-07b3-41f5-94cd-f819d7c1fc76}Gw64.sys C:\Windows\System32\drivers\{6c84eb28-66c4-4e3d-8a5a-46ab94f0575a}Gw64.sys C:\Windows\System32\drivers\{7012eec1-4f37-42d4-a2cd-26727494d248}Gw64.sys C:\Windows\System32\drivers\{733fb217-c049-41ba-9504-3f2045e61977}Gw64.sys C:\Windows\System32\drivers\{949aba83-1d7f-4d0b-b0ba-203450825231}Gw64.sys C:\Windows\System32\drivers\{a6762132-8e80-4305-b1ba-2bec91757ac2}Gw64.sys C:\Windows\System32\drivers\{dc592624-f532-4311-9fc7-6920126fc404}Gw64.sys C:\Windows\System32\drivers\{f5d136d7-adc2-4c84-85b2-e564334ab0bc}Gw64.sys C:\Windows\System32\drivers\{fce396ae-d8d1-4789-946e-2106fbe4292b}Gw64.sys Folder: C:\Users\Bartek\AppData\Roaming\Opera Software\Opera Stable\Extensions CMD: type "C:\Users\Bartek\AppData\Roaming\Opera Software\Opera Stable\Preferences" Reg: reg query "HKLM\SOFTWARE\Clients\StartMenuInternet\OperaStable\shell\open\command" /s ***************** Processes closed successfully. IePluginServices => Service deleted successfully. Update AdvanceElite => Service deleted successfully. Update Framed Display => Service deleted successfully. Util AdvanceElite => Service deleted successfully. Util Framed Display => Service deleted successfully. {00aec75d-051f-41a9-9837-e94ac4f56303}Gw64 => Service stopped successfully. {00aec75d-051f-41a9-9837-e94ac4f56303}Gw64 => Service deleted successfully. {02bbe9df-d3b0-43f4-8dcb-e24500d3308f}Gw64 => Service stopped successfully. {02bbe9df-d3b0-43f4-8dcb-e24500d3308f}Gw64 => Service deleted successfully. {1de2a23f-1c23-4ea1-8ef4-79bc5c5cea78}Gw64 => Service stopped successfully. {1de2a23f-1c23-4ea1-8ef4-79bc5c5cea78}Gw64 => Service deleted successfully. {3b808196-ff63-49ee-b33b-efdf51723eca}Gw64 => Service stopped successfully. {3b808196-ff63-49ee-b33b-efdf51723eca}Gw64 => Service deleted successfully. {3fa44d1f-c300-4673-a8c1-5ba05468b4bd}Gw64 => Service stopped successfully. {3fa44d1f-c300-4673-a8c1-5ba05468b4bd}Gw64 => Service deleted successfully. {4096aedf-3f28-4c8e-aebe-00255138fa8a}Gw64 => Service stopped successfully. {4096aedf-3f28-4c8e-aebe-00255138fa8a}Gw64 => Service deleted successfully. {4530e639-76ab-4435-889d-a5e81ae090a4}Gw64 => Service stopped successfully. {4530e639-76ab-4435-889d-a5e81ae090a4}Gw64 => Service deleted successfully. {46a147d8-5171-42d8-b8a8-6a187525781d}Gw64 => Service stopped successfully. {46a147d8-5171-42d8-b8a8-6a187525781d}Gw64 => Service deleted successfully. {5d78e0ee-ca60-46a4-9492-4f24429cc925}Gw64 => Service stopped successfully. {5d78e0ee-ca60-46a4-9492-4f24429cc925}Gw64 => Service deleted successfully. {67f29abb-07b3-41f5-94cd-f819d7c1fc76}Gw64 => Service stopped successfully. {67f29abb-07b3-41f5-94cd-f819d7c1fc76}Gw64 => Service deleted successfully. {6c84eb28-66c4-4e3d-8a5a-46ab94f0575a}Gw64 => Service stopped successfully. {6c84eb28-66c4-4e3d-8a5a-46ab94f0575a}Gw64 => Service deleted successfully. {7012eec1-4f37-42d4-a2cd-26727494d248}Gw64 => Service stopped successfully. {7012eec1-4f37-42d4-a2cd-26727494d248}Gw64 => Service deleted successfully. {733fb217-c049-41ba-9504-3f2045e61977}Gw64 => Service stopped successfully. {733fb217-c049-41ba-9504-3f2045e61977}Gw64 => Service deleted successfully. {949aba83-1d7f-4d0b-b0ba-203450825231}Gw64 => Service stopped successfully. {949aba83-1d7f-4d0b-b0ba-203450825231}Gw64 => Service deleted successfully. {a6762132-8e80-4305-b1ba-2bec91757ac2}Gw64 => Service stopped successfully. {a6762132-8e80-4305-b1ba-2bec91757ac2}Gw64 => Service deleted successfully. {dc592624-f532-4311-9fc7-6920126fc404}Gw64 => Service stopped successfully. {dc592624-f532-4311-9fc7-6920126fc404}Gw64 => Service deleted successfully. {f5d136d7-adc2-4c84-85b2-e564334ab0bc}Gw64 => Service stopped successfully. {f5d136d7-adc2-4c84-85b2-e564334ab0bc}Gw64 => Service deleted successfully. {fce396ae-d8d1-4789-946e-2106fbe4292b}Gw64 => Service stopped successfully. {fce396ae-d8d1-4789-946e-2106fbe4292b}Gw64 => Service deleted successfully. esgiguard => Service deleted successfully. C:\Windows\system32\GroupPolicy\Machine => Moved successfully. C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully. "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully. Chrome HomePage deleted successfully. Chrome StartupUrls deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk => Shortcut argument was removed successfully. C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk => Shortcut argument was removed successfully. C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk => Shortcut argument was removed successfully. C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk => Shortcut argument was restored successfully. C:\Users\Bartek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk => Shortcut argument was removed successfully. C:\Users\Bartek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk => Shortcut argument was removed successfully. C:\Users\Bartek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk => Shortcut argument was removed successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. "HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully. "HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. "HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{05b5ef3f-4c6a-426e-b77e-48ebb3e721f1}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{05b5ef3f-4c6a-426e-b77e-48ebb3e721f1}" => Key deleted successfully. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" => Key deleted successfully. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3b2cb4c8-72ab-4b25-8fa1-219b36a60bed}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{3b2cb4c8-72ab-4b25-8fa1-219b36a60bed}" => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} => value deleted successfully. "HKCR\CLSID\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}" => Key deleted successfully. C:\Program Files\Enigma Software Group => Moved successfully. C:\Program Files (x86)\Optimizer Pro => Moved successfully. C:\Program Files (x86)\SupTab => Moved successfully. C:\ProgramData\374311380 => Moved successfully. C:\ProgramData\IePluginServices => Moved successfully. C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Preferences => Moved successfully. C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter => Moved successfully. C:\Users\Bartek\AppData\Roaming\SupTab => Moved successfully. C:\Users\Bartek\AppData\Roaming\Systweak => Moved successfully. C:\Users\Bartek\Documents\Optimizer Pro => Moved successfully. C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP => Moved successfully. C:\Windows\system32\roboot64.exe => Moved successfully. C:\Windows\System32\drivers\{00aec75d-051f-41a9-9837-e94ac4f56303}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{02bbe9df-d3b0-43f4-8dcb-e24500d3308f}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{1de2a23f-1c23-4ea1-8ef4-79bc5c5cea78}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{3b808196-ff63-49ee-b33b-efdf51723eca}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{3fa44d1f-c300-4673-a8c1-5ba05468b4bd}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{4096aedf-3f28-4c8e-aebe-00255138fa8a}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{4530e639-76ab-4435-889d-a5e81ae090a4}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{46a147d8-5171-42d8-b8a8-6a187525781d}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{5d78e0ee-ca60-46a4-9492-4f24429cc925}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{67f29abb-07b3-41f5-94cd-f819d7c1fc76}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{6c84eb28-66c4-4e3d-8a5a-46ab94f0575a}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{7012eec1-4f37-42d4-a2cd-26727494d248}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{733fb217-c049-41ba-9504-3f2045e61977}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{949aba83-1d7f-4d0b-b0ba-203450825231}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{a6762132-8e80-4305-b1ba-2bec91757ac2}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{dc592624-f532-4311-9fc7-6920126fc404}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{f5d136d7-adc2-4c84-85b2-e564334ab0bc}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{fce396ae-d8d1-4789-946e-2106fbe4292b}Gw64.sys => Moved successfully. ========================= Folder: C:\Users\Bartek\AppData\Roaming\Opera Software\Opera Stable\Extensions ======================== Directory Not Found ========= type "C:\Users\Bartek\AppData\Roaming\Opera Software\Opera Stable\Preferences" ========= ========= End of CMD: ========= ========= reg query "HKLM\SOFTWARE\Clients\StartMenuInternet\OperaStable\shell\open\command" /s ========= HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\OperaStable\shell\open\command (Default) REG_SZ "C:\Program Files (x86)\Opera\Launcher.exe" ========= End of Reg: ========= The system needed a reboot. ==== End of Fixlog ====