Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-01-2015 Ran by user at 2015-01-07 15:07:59 Run:1 Running from C:\Users\user\Downloads Loaded Profile: user (Available profiles: user) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: CreateRestorePoint: CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp120141223 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp120141223 HKU\S-1-5-21-3948689686-701338284-1942790856-1000\Software\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp120141223 SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = ${SEARCH_URL}{searchTerms} SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = ${SEARCH_URL}{searchTerms} SearchScopes: HKU\S-1-5-21-3948689686-701338284-1942790856-1000 -> DefaultScope {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = http://pl.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo SearchScopes: HKU\S-1-5-21-3948689686-701338284-1942790856-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://startsear.ch/?src=sp&aff=51&cf=2b2a1120-1f77-11e1-92ca-e0cb4e49e9d8&q={searchTerms} SearchScopes: HKU\S-1-5-21-3948689686-701338284-1942790856-1000 -> {6424EBC6-FF28-456C-B234-4F3B05A9C433} URL = http://startsear.ch/?aff=1&src=sp&cf=2b2a1120-1f77-11e1-92ca-e0cb4e49e9d8&q={searchTerms} SearchScopes: HKU\S-1-5-21-3948689686-701338284-1942790856-1000 -> {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = http://pl.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo BHO-x32: No Name -> {cbfb5c65-652c-3e10-9d9a-e586816d9342} -> No File Toolbar: HKU\S-1-5-21-3948689686-701338284-1942790856-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Task: {669DCF2F-E074-4F10-B12E-2BA69EC45636} - \RegClean Pro No Task File <==== ATTENTION Task: {BE6F370A-2822-4692-BA44-3246E748166C} - System32\Tasks\{05F53984-5AC4-42FD-BFF9-4BF874278055} => pcalua.exe -a "C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe" HKU\S-1-5-21-3948689686-701338284-1942790856-1000\Software\Classes\.exe: => <===== ATTENTION! S3 ALSysIO; \??\C:\Users\user\AppData\Local\Temp\ALSysIO64.sys [X] S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X] S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X] S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X] S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X] S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X] S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X] C:\Program Files (x86)\Elex-tech C:\Program Files (x86)\LiveVDO plugin C:\Program Files (x86)\Mozilla Firefox\extensions C:\Program Files (x86)\Mozilla Firefox\plugins C:\Users\user\AppData\Roaming\eCyber C:\Users\user\AppData\Roaming\Elex-tech C:\Users\user\Downloads\yet_another_cleaner_bbs.exe Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f Reg: reg delete HKCU\Software\Google\Chrome /f Reg: reg delete HKLM\SOFTWARE\Google\Chrome /f Reg: reg delete "HKLM\SOFTWARE\mozilla\Mozilla Firefox 3.6.8" /f Reg: reg delete "HKLM\SOFTWARE\mozilla\Mozilla Firefox 18.0" /f Reg: reg delete "HKLM\SOFTWARE\mozilla\Mozilla Firefox 33.0.1" /f EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully. "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKU\S-1-5-21-3948689686-701338284-1942790856-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully. HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found. HKU\S-1-5-21-3948689686-701338284-1942790856-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully. "HKU\S-1-5-21-3948689686-701338284-1942790856-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully. HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found. "HKU\S-1-5-21-3948689686-701338284-1942790856-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6424EBC6-FF28-456C-B234-4F3B05A9C433}" => Key deleted successfully. HKCR\CLSID\{6424EBC6-FF28-456C-B234-4F3B05A9C433} => Key not found. "HKU\S-1-5-21-3948689686-701338284-1942790856-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{8EEAC88A-079B-4b2c-80C1-7836F79EB40A}" => Key deleted successfully. HKCR\CLSID\{8EEAC88A-079B-4b2c-80C1-7836F79EB40A} => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cbfb5c65-652c-3e10-9d9a-e586816d9342}" => Key deleted successfully. HKCR\Wow6432Node\CLSID\{cbfb5c65-652c-3e10-9d9a-e586816d9342} => Key not found. HKU\S-1-5-21-3948689686-701338284-1942790856-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => value deleted successfully. HKCR\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Key not found. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{669DCF2F-E074-4F10-B12E-2BA69EC45636}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{669DCF2F-E074-4F10-B12E-2BA69EC45636}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BE6F370A-2822-4692-BA44-3246E748166C}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BE6F370A-2822-4692-BA44-3246E748166C}" => Key deleted successfully. C:\Windows\System32\Tasks\{05F53984-5AC4-42FD-BFF9-4BF874278055} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{05F53984-5AC4-42FD-BFF9-4BF874278055}" => Key deleted successfully. "HKU\S-1-5-21-3948689686-701338284-1942790856-1000\Software\Classes\.exe" => Key deleted successfully. ALSysIO => Service deleted successfully. ew_hwusbdev => Service deleted successfully. ew_usbenumfilter => Service deleted successfully. huawei_cdcacm => Service deleted successfully. huawei_enumerator => Service deleted successfully. huawei_ext_ctrl => Service deleted successfully. huawei_wwanecm => Service deleted successfully. "C:\Program Files (x86)\Elex-tech" => File/Directory not found. "C:\Program Files (x86)\LiveVDO plugin" => File/Directory not found. C:\Program Files (x86)\Mozilla Firefox\extensions => Moved successfully. C:\Program Files (x86)\Mozilla Firefox\plugins => Moved successfully. "C:\Users\user\AppData\Roaming\eCyber" => File/Directory not found. "C:\Users\user\AppData\Roaming\Elex-tech" => File/Directory not found. C:\Users\user\Downloads\yet_another_cleaner_bbs.exe => Moved successfully. ========= reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKCU\Software\Google\Chrome /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Google\Chrome /f ========= Bť¤D: System nie znalazˆ w rejestrze okre˜lonego klucza albo warto˜ci. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\mozilla\Mozilla Firefox 3.6.8" /f ========= Bť¤D: System nie znalazˆ w rejestrze okre˜lonego klucza albo warto˜ci. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\mozilla\Mozilla Firefox 18.0" /f ========= Bť¤D: System nie znalazˆ w rejestrze okre˜lonego klucza albo warto˜ci. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\mozilla\Mozilla Firefox 33.0.1" /f ========= Bť¤D: System nie znalazˆ w rejestrze okre˜lonego klucza albo warto˜ci. ========= End of Reg: ========= EmptyTemp: => Removed 586.2 MB temporary data. The system needed a reboot. ==== End of Fixlog 15:09:50 ====