Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 19-01-2015 Ran by Przemek at 2015-01-22 18:46:17 Run:1 Running from C:\Users\Przemek\Downloads Loaded Profiles: Przemek (Available profiles: Przemek) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: CreateRestorePoint: R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158896 2015-01-16] (XTab system) ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.mystartsearch.com/?type=sc&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.mystartsearch.com/?type=sc&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 ShortcutWithArgument: C:\Users\Przemek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.mystartsearch.com/?type=sc&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 ShortcutWithArgument: C:\Users\Przemek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.mystartsearch.com/?type=sc&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 ShortcutWithArgument: C:\Users\Przemek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.mystartsearch.com/?type=sc&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 ShortcutWithArgument: C:\Users\Przemek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.mystartsearch.com/?type=sc&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 ShortcutWithArgument: C:\Users\Przemek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.mystartsearch.com/?type=sc&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hp&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hp&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=ds&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=ds&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hp&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hp&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=ds&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=ds&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&q={searchTerms} HKU\S-1-5-21-3634938514-2851733019-2585341248-1002\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=dspp&ts=1421440691&from=cor&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&q={searchTerms} HKU\S-1-5-21-3634938514-2851733019-2585341248-1002\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hp&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 HKU\S-1-5-21-3634938514-2851733019-2585341248-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hp&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 HKU\S-1-5-21-3634938514-2851733019-2585341248-1002\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=dspp&ts=1421440691&from=cor&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=sc&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&q={searchTerms} SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&q={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&q={searchTerms} SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&q={searchTerms} SearchScopes: HKU\S-1-5-21-3634938514-2851733019-2585341248-1002 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&ts=1421442285&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3634938514-2851733019-2585341248-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&ts=1421442285&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3634938514-2851733019-2585341248-1002 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&ts=1421442285&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3634938514-2851733019-2585341248-1002 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&ts=1421442285&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3634938514-2851733019-2585341248-1002 -> {D9AD20EC-DEC9-4003-B40D-B468B2D1CA33} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&ts=1421442285&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3634938514-2851733019-2585341248-1002 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792&ts=1421442285&type=default&q={searchTerms} BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\XTab\SupTab.dll (Thinknice Co. Limited) FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\Przemek\AppData\Roaming\Mozilla\Firefox\Profiles\k5zzj4ga.default\extensions\fftoolbar2014@etech.com FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Przemek\AppData\Roaming\Mozilla\Firefox\Profiles\k5zzj4ga.default\extensions\faststartff@gmail.com FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://www.mystartsearch.com/?type=sc&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.mystartsearch.com/?type=sc&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 CHR HomePage: Default -> hxxp://www.mystartsearch.com/?type=hp&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792 CHR StartupUrls: Default -> "hxxp://www.mystartsearch.com/?type=hp&ts=1421442187&from=smt&uid=ST1000LM024XHN-M101MBB_S30YJ9HF916792" CHR DefaultSearchKeyword: Default -> omiga-plus C:\Program Files (x86)\XTab C:\ProgramData\APN C:\ProgramData\IHProtectUpDate C:\ProgramData\Temp C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Preferences C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Local Storage\*localstorage* C:\Users\Przemek\AppData\Roaming\mystartsearch C:\Users\Przemek\AppData\Roaming\WebApp Reg: reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall" /f EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. IHProtect Service => Service deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk => Shortcut argument was removed successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk => Shortcut argument was removed successfully. C:\Users\Przemek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk => Shortcut argument was removed successfully. C:\Users\Przemek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk => Shortcut argument was removed successfully. C:\Users\Przemek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk => Shortcut argument was removed successfully. C:\Users\Przemek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk => Shortcut argument was removed successfully. C:\Users\Przemek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk => Shortcut argument was removed successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKU\S-1-5-21-3634938514-2851733019-2585341248-1002\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKU\S-1-5-21-3634938514-2851733019-2585341248-1002\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKU\S-1-5-21-3634938514-2851733019-2585341248-1002\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKU\S-1-5-21-3634938514-2851733019-2585341248-1002\Software\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully. HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully. HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKU\S-1-5-21-3634938514-2851733019-2585341248-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully. "HKU\S-1-5-21-3634938514-2851733019-2585341248-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully. HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found. "HKU\S-1-5-21-3634938514-2851733019-2585341248-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}" => Key deleted successfully. HKCR\CLSID\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} => Key not found. "HKU\S-1-5-21-3634938514-2851733019-2585341248-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. "HKU\S-1-5-21-3634938514-2851733019-2585341248-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D9AD20EC-DEC9-4003-B40D-B468B2D1CA33}" => Key deleted successfully. HKCR\CLSID\{D9AD20EC-DEC9-4003-B40D-B468B2D1CA33} => Key not found. "HKU\S-1-5-21-3634938514-2851733019-2585341248-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}" => Key deleted successfully. HKCR\CLSID\{E733165D-CBCF-4FDA-883E-ADEF965B476C} => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" => Key deleted successfully. HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\fftoolbar2014@etech.com => value deleted successfully. HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\faststartff@gmail.com => value deleted successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\\Default => Value was restored successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command\\Default => Value was restored successfully. Chrome HomePage deleted successfully. Chrome StartupUrls deleted successfully. Chrome DefaultSearchKeyword deleted successfully. C:\Program Files (x86)\XTab => Moved successfully. C:\ProgramData\APN => Moved successfully. C:\ProgramData\IHProtectUpDate => Moved successfully. C:\ProgramData\Temp => Moved successfully. C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Preferences => Moved successfully. C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Local Storage\*localstorage* => Moved successfully. C:\Users\Przemek\AppData\Roaming\mystartsearch => Moved successfully. C:\Users\Przemek\AppData\Roaming\WebApp => Moved successfully. ========= reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= EmptyTemp: => Removed 2.2 GB temporary data. The system needed a reboot. ==== End of Fixlog 18:48:33 ====