Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 23-11-2014 Ran by Serge_2 at 2014-11-25 10:28:08 Run:1 Running from C:\Users\Serge_2\Downloads Loaded Profile: Serge_2 (Available profiles: Serge_2) Boot Mode: Normal ============================================== Content of fixlist: ***************** [noparse]CloseProcesses: CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION HKU\S-1-5-21-929553786-925988434-3115227362-1002\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-929553786-925988434-3115227362-1002\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sweet-page.com/?type=hp&ts=1407597502&from=cor&uid=WDCXWD1200BEVS-22UST0_WD-WXC90709687796877 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sweet-page.com/?type=hp&ts=1407597502&from=cor&uid=WDCXWD1200BEVS-22UST0_WD-WXC90709687796877 HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-929553786-925988434-3115227362-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1407597502&from=cor&uid=WDCXWD1200BEVS-22UST0_WD-WXC90709687796877&q={searchTerms} SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1407597502&from=cor&uid=WDCXWD1200BEVS-22UST0_WD-WXC90709687796877&q={searchTerms} SearchScopes: HKU\S-1-5-21-929553786-925988434-3115227362-1002 -> {16E872E1-50B1-4BF9-99CA-0A10714FA03E} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_uid=6F247EE3-0276-4345-8493-43D91FE34D31&apn_sauid=4CDE46A3-3158-468A-96A1-93E6D68DDEE8 Toolbar: HKU\S-1-5-21-929553786-925988434-3115227362-1002 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation) S3 catchme; \??\C:\Users\Serge_2\AppData\Local\Temp\catchme.sys [X] S1 DritekPortIO; \??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys [X] S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X] S1 MpKslf0671de6; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{DF7B2038-272D-4756-A7D9-44EA1A45F0D3}\MpKslf0671de6.sys [X] Task: {4B3D42DB-F52C-4F96-BEAF-3B3A5230E74C} - System32\Tasks\{522D50C1-0E30-4865-BB1A-CDA65CEC6818} => Iexplore.exe http://ui.skype.com/ui/0/5.9.0.123/pl/abandoninstall?page=tsProgressBar Task: {8D8C4713-C35C-4EC2-AD06-809615B8A76C} - System32\Tasks\{008AA0E2-0804-46C0-A681-8FAB434B07F0} => Iexplore.exe http://ui.skype.com/ui/0/6.1.0.129.272/pl/abandoninstall?page=tsProgressBar C:\ProgramData\APN C:\ProgramData\Spybot - Search & Destroy C:\Program Files\Spybot - Search & Destroy 2 C:\Users\Serge_2\AppData\Roaming\Mozilla C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension CMD: sc config LightScribeService start= demand CMD: sc config SamSs start= auto Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0} /f Reg: reg delete HKCU\Software\Mozilla /f Reg: reg delete HKLM\SOFTWARE\Mozilla /f Reg: reg delete HKLM\SOFTWARE\mozilla.org /f Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\MpsSvc" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\SamSs" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Acer Tour Reminder" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MSC" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PCMService' /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SDTray" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Spybot-S&D Cleaning" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WarReg_PopUp" /f Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main" /f Hosts: EmptyTemp:[/noparse] ***************** [noparse]CloseProcesses: => Error: No automatic fix found for this entry. "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully. HKU\S-1-5-21-929553786-925988434-3115227362-1002\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKU\S-1-5-21-929553786-925988434-3115227362-1002\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully. "HKU\S-1-5-21-929553786-925988434-3115227362-1002\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. "HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key not found. "HKU\S-1-5-21-929553786-925988434-3115227362-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{16E872E1-50B1-4BF9-99CA-0A10714FA03E}" => Key deleted successfully. "HKCR\CLSID\{16E872E1-50B1-4BF9-99CA-0A10714FA03E}" => Key not found. HKU\S-1-5-21-929553786-925988434-3115227362-1002\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully. "HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}" => Key not found. AppMgmt => Service deleted successfully. catchme => Service deleted successfully. DritekPortIO => Service deleted successfully. hwdatacard => Service deleted successfully. MpKslf0671de6 => Service deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4B3D42DB-F52C-4F96-BEAF-3B3A5230E74C}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4B3D42DB-F52C-4F96-BEAF-3B3A5230E74C}" => Key deleted successfully. C:\Windows\System32\Tasks\{522D50C1-0E30-4865-BB1A-CDA65CEC6818} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{522D50C1-0E30-4865-BB1A-CDA65CEC6818}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8D8C4713-C35C-4EC2-AD06-809615B8A76C}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8D8C4713-C35C-4EC2-AD06-809615B8A76C}" => Key deleted successfully. C:\Windows\System32\Tasks\{008AA0E2-0804-46C0-A681-8FAB434B07F0} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{008AA0E2-0804-46C0-A681-8FAB434B07F0}" => Key deleted successfully. C:\ProgramData\APN => Moved successfully. C:\ProgramData\Spybot - Search & Destroy => Moved successfully. C:\Program Files\Spybot - Search & Destroy 2 => Moved successfully. C:\Users\Serge_2\AppData\Roaming\Mozilla => Moved successfully. C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension => Moved successfully. ========= sc config LightScribeService start= demand ========= [SC] ChangeServiceConfig SUKCES ========= End of CMD: ========= ========= sc config SamSs start= auto ========= [SC] ChangeServiceConfig SUKCES ========= End of CMD: ========= ========= reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0} /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKCU\Software\Mozilla /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Mozilla /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\mozilla.org /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\MozillaPlugins /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\MpsSvc" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\SamSs" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Acer Tour Reminder" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MSC" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PCMService' /f =========