Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-01-2015 02 Ran by Administrator at 2015-01-14 15:02:51 Run:1 Running from C:\Users\Administrator\Downloads Loaded Profile: Administrator (Available profiles: KSIEGOWY & Administrator) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: CreateRestorePoint: testsigning: ==> testsigning is on. Check for possible unsigned rootkit driver <===== ATTENTION! R2 AmmyyAdmin; C:\Users\KSIEGOWY\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\21MHOHVE\pomoc.exe [743704 2014-10-23] (Ammyy LLC) S2 HP Health Check Service; "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe" [X] S3 hpqwmiex; "C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe" [X] HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AmmyyAdmin => ""="Service" HKLM-x32\...\Run: [File Sanitizer] => c:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe HKLM-x32\...\Run: [{4e8405fa-8ada-47b0-5da9-f8edc703f718}] => "C:\ProgramData\Microsoft\{4e8405fa-8ada-47b0-5da9-f8edc703f718}\{4e8405fa-8ada-47b0-5da9-f8edc703f718}.exe" HKLM\...\Policies\Explorer\Run: [{4e8405fa-8ada-47b0-5da9-f8edc703f718}] => "C:\ProgramData\Microsoft\{4e8405fa-8ada-47b0-5da9-f8edc703f718}\{4e8405fa-8ada-47b0-5da9-f8edc703f718}.exe" No File BootExecute: autocheck autochk * sh4native Sh4Removal Task: {51C3C8E4-1F4E-4237-8F87-358D9DC2425E} - System32\Tasks\{541967FB-A469-4720-B6CB-996F17A61731} => pcalua.exe -a "C:\Users\KSIEGOWY\Desktop\pomoc (1).exe" -d C:\Users\KSIEGOWY\Desktop Task: {55FF654F-51F6-4B94-A471-4EDA360B2139} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe Task: {6DFABE97-4269-4914-AA07-D794CD7C4F01} - System32\Tasks\{38602D3E-9490-4B79-B466-0AF559CC1BF4} => Iexplore.exe http://ui.skype.com/ui/0/6.6.0.106/pl/abandoninstall?page=tsMain Task: {7BC72F8E-CFB7-4229-8611-C79FFE51BFCF} - System32\Tasks\{15840900-6F78-4363-A946-83865712334C} => pcalua.exe -a "G:\kopia dysku D\install\LJ 3030\lj30xx_3380pcl6-pi.exe" -d "G:\kopia dysku D\install\LJ 3030" Task: {955782A8-A447-4D8D-8919-884E3C33A1EA} - System32\Tasks\{B3F322FB-BAC1-45A5-B4D6-6467D1180C8C} => pcalua.exe -a C:\Users\KSIEGOWY\Downloads\lj30xx_3380pcl6-pi.exe -d C:\Users\KSIEGOWY\Desktop Task: {C80C2B81-B1A7-412B-BC3D-E5C376BFBF5D} - System32\Tasks\{EF62DE4A-D9CD-4295-ADF7-CF2CEE14D8C1} => Iexplore.exe http://ui.skype.com/ui/0/5.6.0.105/pl/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;toolbarpresent,google-chrome:notoffered;alreadyoffered Task: {C8E75326-E66C-4E7D-A780-4AD363E2387D} - System32\Tasks\{C39475A6-E07B-4058-B5AC-A5D69DDAF47A} => Iexplore.exe http://ui.skype.com/ui/0/6.6.0.106/pl/abandoninstall?page=tsBing Task: {CA0B4F29-B941-4830-9B67-E0820300E630} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe Task: {D419364E-5D3B-4D5C-87E6-18D50171458A} - System32\Tasks\wckfgeb => C:\Users\KSIEGOWY\AppData\Local\Temp\jqlwefm.exe <==== ATTENTION Task: {F194D71C-3157-4F3F-B70A-C64D4076E794} - System32\Tasks\{C04B678D-7D3D-4B8C-8187-B31F5E7509E9} => Iexplore.exe http://ui.skype.com/ui/0/5.8.0.156/pl/abandoninstall?page=tsMain StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://eu.ask.com/web?q={searchterms}&l=dis&o=CMDTDF SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&appid=102&systemid=406&sr=0&q={searchTerms} SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://eu.ask.com/web?q={searchterms}&l=dis&o=CMDTDF SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&appid=102&systemid=406&sr=0&q={searchTerms} SearchScopes: HKU\S-1-5-21-3668452077-1106565234-3799211801-500 -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = BHO: No Name -> {4F524A2D-5637-006A-76A7-7A786E7484D7} -> No File BHO-x32: Babylon toolbar helper -> {2EECD738-5844-4a99-B4B6-146BF802613B} -> No File BHO-x32: Searchqu Toolbar -> {99079a25-328f-4bd4-be04-00955acaa0a7} -> C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll No File Toolbar: HKLM - No Name - !{EEE6C35B-6118-11DC-9C72-001320C79847} - No File Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll No File Toolbar: HKLM-x32 - No Name - !{EEE6C35B-6118-11DC-9C72-001320C79847} - No File Toolbar: HKU\S-1-5-21-3668452077-1106565234-3799211801-500 -> No Name - {4F524A2D-5637-006A-76A7-7A786E7484D7} - No File C:\spyhunter.fix C:\Users\Administrator\Desktop\SpyHunter C:\Users\KSIEGOWY\Desktop\SpyHunter C:\Users\KSIEGOWY\Documents\Decrypt All Files fafktzg.bmp C:\Users\KSIEGOWY\Documents\Decrypt All Files fafktzg.txt C:\Windows\system32\Drivers\etc\hosts.txt C:\Windows\SysWOW64\sh4native.exe RemoveDirectory: C:\Kaspersky Rescue Disk 10.0 RemoveDirectory: C:\TDSSKiller_Quarantine RemoveDirectory: C:\ProgramData\ESET RemoveDirectory: C:\Users\KSIEGOWY\Documents\Nieużywane\archiwum_stary\E\Program Files\Norton AntiVirus RemoveDirectory: C:\Users\KSIEGOWY\Documents\Nieużywane\archiwum_stary\E\WINDOWS RemoveDirectory: C:\Windows\Installer\{70AA7602-A4C6-3B7F-16CC-5E36F687AED5} Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /f Reg: reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} /f Reg: reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} /f Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f Hosts: EmptyTemp: ***************** Processes closed successfully. Error: (0) Failed to create a restore point. Operacja ukoäczona pomy˜lnie. AmmyyAdmin => Service deleted successfully. HP Health Check Service => Service deleted successfully. hpqwmiex => Service deleted successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Network\AmmyyAdmin" => Key deleted successfully. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\File Sanitizer => value deleted successfully. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\{4e8405fa-8ada-47b0-5da9-f8edc703f718} => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\{4e8405fa-8ada-47b0-5da9-f8edc703f718} => value deleted successfully. HKLM\System\CurrentControlSet\Control\Session Manager\\BootExecute => Value was restored successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{51C3C8E4-1F4E-4237-8F87-358D9DC2425E}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{51C3C8E4-1F4E-4237-8F87-358D9DC2425E}" => Key deleted successfully. C:\Windows\System32\Tasks\{541967FB-A469-4720-B6CB-996F17A61731} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{541967FB-A469-4720-B6CB-996F17A61731}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{55FF654F-51F6-4B94-A471-4EDA360B2139}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{55FF654F-51F6-4B94-A471-4EDA360B2139}" => Key deleted successfully. C:\Windows\System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Hewlett-Packard\HP Support Assistant\PC Health Analysis" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6DFABE97-4269-4914-AA07-D794CD7C4F01}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6DFABE97-4269-4914-AA07-D794CD7C4F01}" => Key deleted successfully. C:\Windows\System32\Tasks\{38602D3E-9490-4B79-B466-0AF559CC1BF4} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{38602D3E-9490-4B79-B466-0AF559CC1BF4}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7BC72F8E-CFB7-4229-8611-C79FFE51BFCF}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7BC72F8E-CFB7-4229-8611-C79FFE51BFCF}" => Key deleted successfully. C:\Windows\System32\Tasks\{15840900-6F78-4363-A946-83865712334C} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{15840900-6F78-4363-A946-83865712334C}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{955782A8-A447-4D8D-8919-884E3C33A1EA}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{955782A8-A447-4D8D-8919-884E3C33A1EA}" => Key deleted successfully. C:\Windows\System32\Tasks\{B3F322FB-BAC1-45A5-B4D6-6467D1180C8C} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{B3F322FB-BAC1-45A5-B4D6-6467D1180C8C}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C80C2B81-B1A7-412B-BC3D-E5C376BFBF5D}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C80C2B81-B1A7-412B-BC3D-E5C376BFBF5D}" => Key deleted successfully. C:\Windows\System32\Tasks\{EF62DE4A-D9CD-4295-ADF7-CF2CEE14D8C1} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{EF62DE4A-D9CD-4295-ADF7-CF2CEE14D8C1}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C8E75326-E66C-4E7D-A780-4AD363E2387D}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C8E75326-E66C-4E7D-A780-4AD363E2387D}" => Key deleted successfully. C:\Windows\System32\Tasks\{C39475A6-E07B-4058-B5AC-A5D69DDAF47A} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C39475A6-E07B-4058-B5AC-A5D69DDAF47A}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CA0B4F29-B941-4830-9B67-E0820300E630}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CA0B4F29-B941-4830-9B67-E0820300E630}" => Key deleted successfully. C:\Windows\System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Hewlett-Packard\HP Support Assistant\PC Tuneup" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{D419364E-5D3B-4D5C-87E6-18D50171458A}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D419364E-5D3B-4D5C-87E6-18D50171458A}" => Key deleted successfully. C:\Windows\System32\Tasks\wckfgeb => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\wckfgeb" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F194D71C-3157-4F3F-B70A-C64D4076E794}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F194D71C-3157-4F3F-B70A-C64D4076E794}" => Key deleted successfully. C:\Windows\System32\Tasks\{C04B678D-7D3D-4B8C-8187-B31F5E7509E9} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C04B678D-7D3D-4B8C-8187-B31F5E7509E9}" => Key deleted successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully. HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}" => Key deleted successfully. HKCR\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => Key not found. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}" => Key deleted successfully. HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully. HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}" => Key deleted successfully. HKCR\Wow6432Node\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}" => Key deleted successfully. HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key not found. HKU\S-1-5-21-3668452077-1106565234-3799211801-500\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4F524A2D-5637-006A-76A7-7A786E7484D7}" => Key deleted successfully. HKCR\CLSID\{4F524A2D-5637-006A-76A7-7A786E7484D7} => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}" => Key deleted successfully. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}" => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\!{EEE6C35B-6118-11DC-9C72-001320C79847} => value deleted successfully. HKCR\CLSID\!{EEE6C35B-6118-11DC-9C72-001320C79847} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{99079a25-328f-4bd4-be04-00955acaa0a7} => value deleted successfully. HKCR\Wow6432Node\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\!{EEE6C35B-6118-11DC-9C72-001320C79847} => value deleted successfully. HKCR\Wow6432Node\CLSID\!{EEE6C35B-6118-11DC-9C72-001320C79847} => Key not found. HKU\S-1-5-21-3668452077-1106565234-3799211801-500\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4F524A2D-5637-006A-76A7-7A786E7484D7} => value deleted successfully. HKCR\CLSID\{4F524A2D-5637-006A-76A7-7A786E7484D7} => Key not found. C:\spyhunter.fix => Moved successfully. C:\Users\Administrator\Desktop\SpyHunter => Moved successfully. C:\Users\KSIEGOWY\Desktop\SpyHunter => Moved successfully. C:\Users\KSIEGOWY\Documents\Decrypt All Files fafktzg.bmp => Moved successfully. C:\Users\KSIEGOWY\Documents\Decrypt All Files fafktzg.txt => Moved successfully. C:\Windows\system32\Drivers\etc\hosts.txt => Moved successfully. C:\Windows\SysWOW64\sh4native.exe => Moved successfully. "C:\Kaspersky Rescue Disk 10.0" => Removed successfully. "C:\TDSSKiller_Quarantine" => Removed successfully. "C:\ProgramData\ESET" => Removed successfully. "C:\Users\KSIEGOWY\Documents\Nieużywane\archiwum_stary\E\Program Files\Norton AntiVirus" => Removed successfully. "C:\Users\KSIEGOWY\Documents\Nieużywane\archiwum_stary\E\WINDOWS" => Removed successfully. "C:\Windows\Installer\{70AA7602-A4C6-3B7F-16CC-5E36F687AED5}" => Removed successfully. ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\MozillaPlugins /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= C:\Windows\System32\Drivers\etc\hosts => Moved successfully. Hosts was reset successfully. EmptyTemp: => Removed 1.5 GB temporary data. The system needed a reboot. ==== End of Fixlog 15:07:24 ====