Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 11-03-2015 Ran by Pc at 2015-03-17 22:39:56 Run:2 Running from G:\Narzedzia\Diagnostyka dla Picasso\FIRST Loaded Profiles: Pc (Available profiles: Pc) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: CreateRestorePoint: R1 {d2c0ab1d-6370-4786-b3bc-16a62a2a98bb}Gt; G:\WINDOWS\System32\drivers\{d2c0ab1d-6370-4786-b3bc-16a62a2a98bb}Gt.sys [55824 2015-03-08] (StdLib) R1 {e4db71b5-18d7-401c-9152-e63e79440e72}Gt; G:\WINDOWS\System32\drivers\{e4db71b5-18d7-401c-9152-e63e79440e72}Gt.sys [55824 2015-03-10] (StdLib) S2 globalUpdate; G:\Program Files\globalUpdate\Update\GoogleUpdate.exe [68608 2015-03-09] (globalUpdate) [File not signed] S3 globalUpdatem; G:\Program Files\globalUpdate\Update\GoogleUpdate.exe [68608 2015-03-09] (globalUpdate) [File not signed] R1 qrnfd_1_10_0_9; system32\drivers\qrnfd_1_10_0_9.sys [X] S4 sptd; System32\Drivers\sptd.sys [X] R4 {0ade837f-26ef-4080-95b6-a675bbebbd2b}Gt; system32\drivers\{0ade837f-26ef-4080-95b6-a675bbebbd2b}Gt.sys [X] Task: G:\WINDOWS\Tasks\APSnotifierPP1.job => G:\Program Files\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: G:\WINDOWS\Tasks\APSnotifierPP2.job => G:\Program Files\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: G:\WINDOWS\Tasks\APSnotifierPP3.job => G:\Program Files\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: G:\WINDOWS\Tasks\CCVL.job => G:\Documents and Settings\Pc\Dane aplikacji\CCVL.exe Task: G:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineCore.job => G:\Program Files\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION Task: G:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineUA.job => G:\Program Files\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION HKLM\...\Run: [upfst_pl_6.exe] => G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\fst_pl_6\upfst_pl_6.exe -runhelper HKLM\...\Run: [fst_pl_19] => [X] HKLM\...\Run: [fst_pl_6] => [X] HKLM\...\Run: [fst_pl_73] => [X] HKLM\...\Run: [fst_pl_99] => [X] HKLM\...\Run: [gmsd_pl_65] => [X] HKLM\...\Run: [upgmsd_pl_65.exe] => G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\gmsd_pl_65\upgmsd_pl_65.exe -runhelper HKU\S-1-5-21-1275210071-117609710-839522115-1003\...\Run: [BearShare] => "G:\Program Files\BearShare Applications\BearShare\BearShare.exe" --lightmode HKU\S-1-5-21-1275210071-117609710-839522115-1003\...\Run: [ISUSPM] => G:\Documents and Settings\All Users\Dane aplikacji\FLEXnet\Connect\11\ISUSPM.exe -scheduler Startup: G:\Documents and Settings\Pc\Menu Start\Programy\Autostart\superpc_soft_partner.lnk GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1426430494&from=face&uid=ST500DM002-1BD142_S2AH3K6EXXXXS2AH3K6E HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1426430494&from=face&uid=ST500DM002-1BD142_S2AH3K6EXXXXS2AH3K6E&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1426430494&from=face&uid=ST500DM002-1BD142_S2AH3K6EXXXXS2AH3K6E HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1426430494&from=face&uid=ST500DM002-1BD142_S2AH3K6EXXXXS2AH3K6E&q={searchTerms} HKU\S-1-5-21-1275210071-117609710-839522115-1003\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/#utm_source=instalki&utm_medium=installer&utm_campaign=instalki HKU\S-1-5-21-1275210071-117609710-839522115-1003\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-1275210071-117609710-839522115-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1426430494&from=face&uid=ST500DM002-1BD142_S2AH3K6EXXXXS2AH3K6E HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "http://www.interia.pl/#utm_source=instalki&utm_medium=installer&utm_campaign=instalki" <======= ATTENTION SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1426430494&from=face&uid=ST500DM002-1BD142_S2AH3K6EXXXXS2AH3K6E&q={searchTerms} SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1426430494&from=face&uid=ST500DM002-1BD142_S2AH3K6EXXXXS2AH3K6E&q={searchTerms} SearchScopes: HKU\S-1-5-21-1275210071-117609710-839522115-1003 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1426430494&from=face&uid=ST500DM002-1BD142_S2AH3K6EXXXXS2AH3K6E&q={searchTerms} SearchScopes: HKU\S-1-5-21-1275210071-117609710-839522115-1003 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1426430494&from=face&uid=ST500DM002-1BD142_S2AH3K6EXXXXS2AH3K6E&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - G:\Program Files\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=sc&ts=1425850244&from=epom2&uid=ST500DM002-1BD142_S2AH3K6EXXXXS2AH3K6E FF Plugin: @staging.google.com/globalUpdate Update;version=10 -> G:\Program Files\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2015-03-09] (globalUpdate) FF Plugin: @staging.google.com/globalUpdate Update;version=4 -> G:\Program Files\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2015-03-09] (globalUpdate) FF HKLM\...\Firefox\Extensions: [searchengine@gmail.com] - G:\Documents and Settings\Pc\Dane aplikacji\Mozilla\Firefox\Profiles\yygpirum.default-1404846490562\extensions\searchengine@gmail.com FF HKLM\...\Firefox\Extensions: [istart_ffnt@gmail.com] - G:\Documents and Settings\Pc\Dane aplikacji\Mozilla\Firefox\Profiles\yygpirum.default-1404846490562\extensions\istart_ffnt@gmail.com G:\Documents and Settings\All Users\Dane aplikacji\{ba121210-d50e-5ae8-ba12-21210d504843} G:\Documents and Settings\All Users\Dane aplikacji\9651896652148095366 G:\Documents and Settings\All Users\Dane aplikacji\cb595a1a00006ece G:\Documents and Settings\All Users\Dane aplikacji\fmhcfkifjpdlmcallfafjkgjemhiddnf G:\Documents and Settings\All Users\Menu Start\Programy\Catalyst Control Center G:\Documents and Settings\Pc\TempWmicBatchFile.bat G:\Documents and Settings\Pc\Dane aplikacji\CCVL.exe G:\Documents and Settings\Pc\Dane aplikacji\CCVL G:\Documents and Settings\Pc\Dane aplikacji\45443439-1425850326-4639-4637-3743FFFFFFFF G:\Documents and Settings\Pc\Dane aplikacji\AnyProtectEx G:\Documents and Settings\Pc\Dane aplikacji\ASPackage G:\Documents and Settings\Pc\Dane aplikacji\istartsurf G:\Documents and Settings\Pc\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\BearShare.lnk G:\Documents and Settings\Pc\Dane aplikacji\mystartsearch G:\Documents and Settings\Pc\Dane aplikacji\systweak G:\Documents and Settings\Pc\Menu Start\Programy\BearShare.lnk G:\Documents and Settings\Pc\Ustawienia lokalne\Temp.dat G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\nsb195.tmp G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\nsg302.tmp G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\nsx2C1.tmp G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\nsy16E.tmp G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\FilesFrog Update Checker G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\globalUpdate G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\SmartWeb G:\Program Files\globalUpdate G:\Program Files\IGS G:\Program Files\predm G:\Program Files\PriuceLesss G:\WINDOWS\system32\029B560A371F4E00AB32838EBC01B9E7 G:\WINDOWS\system32\BasementDusterOff.ini G:\WINDOWS\system32\BDL.dll G:\WINDOWS\system32\roboot.exe G:\WINDOWS\system32\TempWmicBatchFile.bat G:\WINDOWS\System32\drivers\{d2c0ab1d-6370-4786-b3bc-16a62a2a98bb}Gt.sys G:\WINDOWS\System32\drivers\{e4db71b5-18d7-401c-9152-e63e79440e72}Gt.sys Reg: reg delete HKLM\SOFTWARE\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D} /f Reg: reg delete HKLM\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96} /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall" /f CMD: netsh winsock reset EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. {d2c0ab1d-6370-4786-b3bc-16a62a2a98bb}Gt => Unable to stop service {d2c0ab1d-6370-4786-b3bc-16a62a2a98bb}Gt => Service deleted successfully. {e4db71b5-18d7-401c-9152-e63e79440e72}Gt => Unable to stop service {e4db71b5-18d7-401c-9152-e63e79440e72}Gt => Service deleted successfully. globalUpdate => Service deleted successfully. globalUpdatem => Service deleted successfully. qrnfd_1_10_0_9 => Unable to stop service qrnfd_1_10_0_9 => Service deleted successfully. sptd => Service deleted successfully. {0ade837f-26ef-4080-95b6-a675bbebbd2b}Gt => Unable to stop service {0ade837f-26ef-4080-95b6-a675bbebbd2b}Gt => Service deleted successfully. G:\WINDOWS\Tasks\APSnotifierPP1.job => Moved successfully. G:\WINDOWS\Tasks\APSnotifierPP2.job => Moved successfully. G:\WINDOWS\Tasks\APSnotifierPP3.job => Moved successfully. G:\WINDOWS\Tasks\CCVL.job => Moved successfully. G:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineCore.job => Moved successfully. G:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineUA.job => Moved successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\upfst_pl_6.exe => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\fst_pl_19 => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\fst_pl_6 => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\fst_pl_73 => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\fst_pl_99 => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\gmsd_pl_65 => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\upgmsd_pl_65.exe => value deleted successfully. HKU\S-1-5-21-1275210071-117609710-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\\BearShare => value deleted successfully. HKU\S-1-5-21-1275210071-117609710-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\\ISUSPM => value deleted successfully. G:\Documents and Settings\Pc\Menu Start\Programy\Autostart\superpc_soft_partner.lnk => Moved successfully. G:\WINDOWS\system32\GroupPolicy\Machine => Moved successfully. G:\WINDOWS\system32\GroupPolicy\GPT.ini => Moved successfully. "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKU\S-1-5-21-1275210071-117609710-839522115-1003\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKU\S-1-5-21-1275210071-117609710-839522115-1003\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKU\S-1-5-21-1275210071-117609710-839522115-1003\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\\Tabs => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKU\S-1-5-21-1275210071-117609710-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully. "HKU\S-1-5-21-1275210071-117609710-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. "HKLM\Software\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10" => Key deleted successfully. G:\Program Files\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll => Moved successfully. "HKLM\Software\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4" => Key deleted successfully. G:\Program Files\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll not found. HKLM\Software\Mozilla\Firefox\Extensions\\searchengine@gmail.com => value deleted successfully. HKLM\Software\Mozilla\Firefox\Extensions\\istart_ffnt@gmail.com => value deleted successfully. G:\Documents and Settings\All Users\Dane aplikacji\{ba121210-d50e-5ae8-ba12-21210d504843} => Moved successfully. G:\Documents and Settings\All Users\Dane aplikacji\9651896652148095366 => Moved successfully. G:\Documents and Settings\All Users\Dane aplikacji\cb595a1a00006ece => Moved successfully. G:\Documents and Settings\All Users\Dane aplikacji\fmhcfkifjpdlmcallfafjkgjemhiddnf => Moved successfully. G:\Documents and Settings\All Users\Menu Start\Programy\Catalyst Control Center => Moved successfully. G:\Documents and Settings\Pc\TempWmicBatchFile.bat => Moved successfully. G:\Documents and Settings\Pc\Dane aplikacji\CCVL.exe => Moved successfully. G:\Documents and Settings\Pc\Dane aplikacji\CCVL => Moved successfully. G:\Documents and Settings\Pc\Dane aplikacji\45443439-1425850326-4639-4637-3743FFFFFFFF => Moved successfully. G:\Documents and Settings\Pc\Dane aplikacji\AnyProtectEx => Moved successfully. G:\Documents and Settings\Pc\Dane aplikacji\ASPackage => Moved successfully. G:\Documents and Settings\Pc\Dane aplikacji\istartsurf => Moved successfully. G:\Documents and Settings\Pc\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\BearShare.lnk => Moved successfully. G:\Documents and Settings\Pc\Dane aplikacji\mystartsearch => Moved successfully. G:\Documents and Settings\Pc\Dane aplikacji\systweak => Moved successfully. G:\Documents and Settings\Pc\Menu Start\Programy\BearShare.lnk => Moved successfully. G:\Documents and Settings\Pc\Ustawienia lokalne\Temp.dat => Moved successfully. G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\nsb195.tmp => Moved successfully. G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\nsg302.tmp => Moved successfully. G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\nsx2C1.tmp => Moved successfully. G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\nsy16E.tmp => Moved successfully. G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\FilesFrog Update Checker => Moved successfully. G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\globalUpdate => Moved successfully. G:\Documents and Settings\Pc\Ustawienia lokalne\Dane aplikacji\SmartWeb => Moved successfully. G:\Program Files\globalUpdate => Moved successfully. G:\Program Files\IGS => Moved successfully. G:\Program Files\predm => Moved successfully. G:\Program Files\PriuceLesss => Moved successfully. G:\WINDOWS\system32\029B560A371F4E00AB32838EBC01B9E7 => Moved successfully. G:\WINDOWS\system32\BasementDusterOff.ini => Moved successfully. G:\WINDOWS\system32\BDL.dll => Moved successfully. G:\WINDOWS\system32\roboot.exe => Moved successfully. G:\WINDOWS\system32\TempWmicBatchFile.bat => Moved successfully. G:\WINDOWS\System32\drivers\{d2c0ab1d-6370-4786-b3bc-16a62a2a98bb}Gt.sys => Moved successfully. G:\WINDOWS\System32\drivers\{e4db71b5-18d7-401c-9152-e63e79440e72}Gt.sys => Moved successfully. ========= reg delete HKLM\SOFTWARE\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D} /f ========= BÅ‚Ä…d: system nie może odnaleźć okreÅ›lonego klucza rejestru lub wartoÅ›ci. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96} /f ========= BÅ‚Ä…d: system nie może odnaleźć okreÅ›lonego klucza rejestru lub wartoÅ›ci. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= netsh winsock reset ========= Pomy˜lnie zresetowano Winsock Catalog. Musisz ponownie uruchomi† komputer, aby ukoäczy† resetowanie. ========= End of CMD: ========= EmptyTemp: => Removed 6 GB temporary data. The system needed a reboot. ==== End of Fixlog 22:42:23 ====