Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 23-02-2015 Ran by Adam at 2015-02-24 21:31:19 Run:1 Running from C:\Users\Adam\Desktop Loaded Profiles: Adam (Available profiles: Adam) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: CreateRestorePoint: R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [487056 2015-02-13] (SysTool PasSame LIMITED) HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=dspp&ts=1423827437&from=smt&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=dspp&ts=1423827437&from=smt&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=dspp&ts=1423827437&from=smt&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=dspp&ts=1423827437&from=smt&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} HKU\S-1-5-21-3211495807-2250388596-1896275332-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hppp&ts=1423827437&from=smt&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866 SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dspp&ts=1423827437&from=smt&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dspp&ts=1423827437&from=smt&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dspp&ts=1423827437&from=smt&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dspp&ts=1423827437&from=smt&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} SearchScopes: HKU\S-1-5-21-3211495807-2250388596-1896275332-1000 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&ts=1423827457&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3211495807-2250388596-1896275332-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&ts=1423827457&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3211495807-2250388596-1896275332-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&ts=1423827457&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3211495807-2250388596-1896275332-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&ts=1423827457&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3211495807-2250388596-1896275332-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&ts=1423827457&type=default&q={searchTerms} FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\mystartsearch.xml StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://www.mystartsearch.com/?type=sc&ts=1423827365&from=smt&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866 BHO: No Name -> {A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} -> No File BHO: No Name -> {FCE3FA8B-BA81-467C-81D8-E43C00D1BC71} -> No File BHO-x32: No Name -> {A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} -> No File HKLM-x32\...\Run: [] => [X] Task: {43BB09F0-C485-4664-84EE-25948177016C} - \GoogleUpdateTaskMachineUA No Task File <==== ATTENTION Task: {57B907E2-EFAB-4357-AF5A-F30800B53B7C} - \{9D7E2E51-0FF5-4959-819D-A00F8223E75A} No Task File <==== ATTENTION Task: {A6B77375-CDBB-487B-90B0-72FF5C526668} - \{03AC028F-6D69-4D38-A960-C87DF9C47C01} No Task File <==== ATTENTION Task: {BDA1DEE0-2EE7-4979-A949-B0EE72BACEFE} - \GoogleUpdateTaskMachineCore No Task File <==== ATTENTION Task: {E42B8748-E286-4B65-A9FF-FE91022D6948} - \{3D45F24C-9663-45CC-B231-66165FD576AE} No Task File <==== ATTENTION Task: {EB33B7BF-844E-4A50-B49A-233460856312} - \Adobe Flash Player Updater No Task File <==== ATTENTION C:\Program Files (x86)\globalUpdate C:\ProgramData\IHProtectUpDate C:\ProgramData\McAfee C:\ProgramData\TEMP C:\ProgramData\WindowsMangerProtect C:\Users\Adam\AppData\Local\CrashRpt C:\Users\Adam\AppData\Local\globalUpdate C:\Users\Public\Documents\GOOBZO C:\Users\Public\Documents\ShopperPro C:\Users\Public\Documents\YTAHelper C:\Users\Adam\Downloads\*(*)-dp*.exe C:\Users\Adam\Downloads\Niepotwierdzony*.crdownload DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\GOOBZOYouTubeAccelerator DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PSUAMain CMD: sc config "Internet Manager. RunOuc" start= disabled CMD: sc config WinDefend start= demand EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. WindowsMangerProtect => Service not found. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKU\S-1-5-21-3211495807-2250388596-1896275332-1000\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKU\S-1-5-21-3211495807-2250388596-1896275332-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully. "HKU\S-1-5-21-3211495807-2250388596-1896275332-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully. HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found. "HKU\S-1-5-21-3211495807-2250388596-1896275332-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}" => Key deleted successfully. HKCR\CLSID\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} => Key not found. "HKU\S-1-5-21-3211495807-2250388596-1896275332-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. "HKU\S-1-5-21-3211495807-2250388596-1896275332-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}" => Key deleted successfully. HKCR\CLSID\{E733165D-CBCF-4FDA-883E-ADEF965B476C} => Key not found. C:\Program Files (x86)\mozilla firefox\searchplugins\mystartsearch.xml => Moved successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\\Default => Value was restored successfully. "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}" => Key deleted successfully. HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} => Key not found. "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}" => Key deleted successfully. HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71} => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}" => Key deleted successfully. HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} => Key not found. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{43BB09F0-C485-4664-84EE-25948177016C}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{43BB09F0-C485-4664-84EE-25948177016C}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{57B907E2-EFAB-4357-AF5A-F30800B53B7C}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{57B907E2-EFAB-4357-AF5A-F30800B53B7C}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{9D7E2E51-0FF5-4959-819D-A00F8223E75A}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A6B77375-CDBB-487B-90B0-72FF5C526668}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A6B77375-CDBB-487B-90B0-72FF5C526668}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{03AC028F-6D69-4D38-A960-C87DF9C47C01}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{BDA1DEE0-2EE7-4979-A949-B0EE72BACEFE}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BDA1DEE0-2EE7-4979-A949-B0EE72BACEFE}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E42B8748-E286-4B65-A9FF-FE91022D6948}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E42B8748-E286-4B65-A9FF-FE91022D6948}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{3D45F24C-9663-45CC-B231-66165FD576AE}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{EB33B7BF-844E-4A50-B49A-233460856312}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EB33B7BF-844E-4A50-B49A-233460856312}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Adobe Flash Player Updater" => Key deleted successfully. C:\Program Files (x86)\globalUpdate => Moved successfully. C:\ProgramData\IHProtectUpDate => Moved successfully. C:\ProgramData\McAfee => Moved successfully. C:\ProgramData\TEMP => Moved successfully. C:\ProgramData\WindowsMangerProtect => Moved successfully. C:\Users\Adam\AppData\Local\CrashRpt => Moved successfully. C:\Users\Adam\AppData\Local\globalUpdate => Moved successfully. C:\Users\Public\Documents\GOOBZO => Moved successfully. C:\Users\Public\Documents\ShopperPro => Moved successfully. C:\Users\Public\Documents\YTAHelper => Moved successfully. C:\Users\Adam\Downloads\*(*)-dp*.exe => Moved successfully. "C:\Users\Adam\Downloads\Niepotwierdzony*.crdownload" => File/Directory not found. HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 => Failed to delete key at first attempt (Error: C0000121), see next line. HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 => Key Deleted Successfully. HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\GOOBZOYouTubeAccelerator => Key Deleted successfully. HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PSUAMain => Key Deleted successfully. ========= sc config "Internet Manager. RunOuc" start= disabled ========= [SC] ChangeServiceConfig SUKCES ========= End of CMD: ========= ========= sc config WinDefend start= demand ========= [SC] ChangeServiceConfig SUKCES ========= End of CMD: ========= EmptyTemp: => Removed 1.1 GB temporary data. The system needed a reboot. ==== End of Fixlog 21:32:14 ====