Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015 Ran by mateusz at 2015-03-18 15:29:31 Run:1 Running from C:\Users\mateusz\Downloads Loaded Profiles: mateusz (Available profiles: mateusz) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: CreateRestorePoint: R2 63816b85; c:\Program Files (x86)\BorderlineMaker\BorderlineMaker.dll [1951232 2015-03-06] () [File not signed] R2 bce312cc; c:\Program Files (x86)\RelaySys\RelaySys.dll [1967104 2015-03-03] () [File not signed] R2 ec9c17f1; c:\Program Files (x86)\SoftwarePlus\SoftwarePlus.dll [1685504 2015-02-26] () [File not signed] R2 Service Mgr RollAround; C:\ProgramData\2a617352-d396-46a3-a71b-5d89535356cf\plugincontainer.exe [581360 2015-03-06] () R2 Update Mgr RollAround; C:\Program Files (x86)\Common Files\2a617352-d396-46a3-a71b-5d89535356cf\updater.exe [388848 2015-03-06] () S3 FairplayKD; \??\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [X] Task: {F0C4F8BA-4B3C-4729-9996-711832756949} - System32\Tasks\Ad-Aware Update (Weekly) => C:\Program Files (x86)\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe HKU\S-1-5-21-945938231-2787147350-3338407632-1000\...\Run: [DAEMON Tools Lite] => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun HKU\S-1-5-21-945938231-2787147350-3338407632-1000\...\MountPoints2: {472f6686-5eac-11e4-b368-5404a6b0d4c8} - H:\setup.exe GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> D:\programy\firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.mystartsearch.com/?type=sc&ts=1419644287&from=wpc&uid=GOODRAMXC40_D6EB07461A7500586642 ShortcutWithArgument: C:\Users\mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.mystartsearch.com/?type=sc&ts=1419644287&from=wpc&uid=GOODRAMXC40_D6EB07461A7500586642 ShortcutWithArgument: C:\Users\mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.mystartsearch.com/?type=sc&ts=1419644287&from=wpc&uid=GOODRAMXC40_D6EB07461A7500586642 ShortcutWithArgument: C:\Users\mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.mystartsearch.com/?type=sc&ts=1419644287&from=wpc&uid=GOODRAMXC40_D6EB07461A7500586642 ShortcutWithArgument: C:\Users\mateusz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.mystartsearch.com/?type=sc&ts=1419644287&from=wpc&uid=GOODRAMXC40_D6EB07461A7500586642 ShortcutWithArgument: C:\Users\mateusz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> D:\programy\firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.mystartsearch.com/?type=sc&ts=1419644287&from=wpc&uid=GOODRAMXC40_D6EB07461A7500586642 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com SearchScopes: HKU\S-1-5-21-945938231-2787147350-3338407632-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = SearchScopes: HKU\S-1-5-21-945938231-2787147350-3338407632-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.key-find.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=GOODRAMXC40_D6EB07461A7500586642&ts=1423219131&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-945938231-2787147350-3338407632-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.key-find.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=GOODRAMXC40_D6EB07461A7500586642&ts=1423219131&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-945938231-2787147350-3338407632-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.key-find.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=GOODRAMXC40_D6EB07461A7500586642&ts=1423219131&type=default&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - iexplore.exe C:\Program Files (x86)\BorderlineMaker C:\Program Files (x86)\Google C:\Program Files (x86)\PrinceCiouPone C:\Program Files (x86)\RelaySys C:\Program Files (x86)\SoftwarePlus C:\Program Files (x86)\Common Files\2a617352-d396-46a3-a71b-5d89535356cf C:\ProgramData\2a617352-d396-46a3-a71b-5d89535356cf C:\ProgramData\3164dfc000001c67 C:\ProgramData\7564552405782015561 C:\ProgramData\aea8cc93-2213-47cf-a265-0391e3461dbb C:\ProgramData\kijgeebfcmjjkffjllnbechheibhhbke C:\ProgramData\MailUpdate C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Call of Duty Advanced Warfare C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavalys C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware C:\ProgramData\Microsoft\Windows\Start Menu\Programs\San Andreas Multiplayer C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SkypEmoticons C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoRotator C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinISD beta C:\Users\mateusz\AppData\Local\69ff07055291669bb2b218.72821112 C:\Users\mateusz\AppData\Local\Google C:\Users\mateusz\AppData\Local\icsxml C:\Users\mateusz\AppData\Local\Opera Software C:\Users\mateusz\AppData\Roaming\CYF C:\Users\mateusz\AppData\Roaming\GoldenGate C:\Users\mateusz\AppData\Roaming\MailUpdate C:\Users\mateusz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk C:\Users\mateusz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\San Andreas Multiplayer.lnk C:\Users\mateusz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Video Rotator.lnk C:\Users\mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Play Games Online.url C:\Users\mateusz\AppData\Roaming\OpenCandy C:\Users\mateusz\AppData\Roaming\Opera Software C:\Users\mateusz\AppData\Roaming\Origin\update.vbe C:\Users\mateusz\AppData\Roaming\SkypeFall C:\Users\mateusz\AppData\Roaming\SkypEmoticons C:\Users\mateusz\Links\8 Ball Pool V10.lnk Reg: reg delete HKCU\Software\Google /f Reg: reg delete HKLM\SOFTWARE\Google /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Google /f EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. 63816b85 => Service not found. bce312cc => Service not found. ec9c17f1 => Service deleted successfully. Service Mgr RollAround => Service not found. Update Mgr RollAround => Service not found. FairplayKD => Service deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F0C4F8BA-4B3C-4729-9996-711832756949}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F0C4F8BA-4B3C-4729-9996-711832756949}" => Key deleted successfully. C:\Windows\System32\Tasks\Ad-Aware Update (Weekly) => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Ad-Aware Update (Weekly)" => Key deleted successfully. HKU\S-1-5-21-945938231-2787147350-3338407632-1000\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite => value deleted successfully. "HKU\S-1-5-21-945938231-2787147350-3338407632-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{472f6686-5eac-11e4-b368-5404a6b0d4c8}" => Key deleted successfully. HKCR\CLSID\{472f6686-5eac-11e4-b368-5404a6b0d4c8} => Key not found. C:\Windows\system32\GroupPolicy\Machine => Moved successfully. C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully. "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk => Shortcut argument was removed successfully. C:\Users\mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk => Shortcut argument was removed successfully. C:\Users\mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk => Shortcut argument was removed successfully. C:\Users\mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk => Shortcut argument was restored successfully. C:\Users\mateusz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk => Shortcut argument was removed successfully. C:\Users\mateusz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk => Shortcut argument was removed successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKU\S-1-5-21-945938231-2787147350-3338407632-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully. "HKU\S-1-5-21-945938231-2787147350-3338407632-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully. HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found. "HKU\S-1-5-21-945938231-2787147350-3338407632-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}" => Key deleted successfully. HKCR\CLSID\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} => Key not found. "HKU\S-1-5-21-945938231-2787147350-3338407632-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}" => Key deleted successfully. HKCR\CLSID\{E733165D-CBCF-4FDA-883E-ADEF965B476C} => Key not found. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. "C:\Program Files (x86)\BorderlineMaker" => File/Directory not found. C:\Program Files (x86)\Google => Moved successfully. C:\Program Files (x86)\PrinceCiouPone => Moved successfully. "C:\Program Files (x86)\RelaySys" => File/Directory not found. C:\Program Files (x86)\SoftwarePlus => Moved successfully. "C:\Program Files (x86)\Common Files\2a617352-d396-46a3-a71b-5d89535356cf" => File/Directory not found. "C:\ProgramData\2a617352-d396-46a3-a71b-5d89535356cf" => File/Directory not found. C:\ProgramData\3164dfc000001c67 => Moved successfully. C:\ProgramData\7564552405782015561 => Moved successfully. C:\ProgramData\aea8cc93-2213-47cf-a265-0391e3461dbb => Moved successfully. C:\ProgramData\kijgeebfcmjjkffjllnbechheibhhbke => Moved successfully. C:\ProgramData\MailUpdate => Moved successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk => Moved successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Call of Duty Advanced Warfare => Moved successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite => Moved successfully. "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome" => File/Directory not found. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavalys => Moved successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware => Moved successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\San Andreas Multiplayer => Moved successfully. "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SkypEmoticons" => File/Directory not found. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client => Moved successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoRotator => Moved successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinISD beta => Moved successfully. C:\Users\mateusz\AppData\Local\69ff07055291669bb2b218.72821112 => Moved successfully. C:\Users\mateusz\AppData\Local\Google => Moved successfully. C:\Users\mateusz\AppData\Local\icsxml => Moved successfully. C:\Users\mateusz\AppData\Local\Opera Software => Moved successfully. C:\Users\mateusz\AppData\Roaming\CYF => Moved successfully. C:\Users\mateusz\AppData\Roaming\GoldenGate => Moved successfully. C:\Users\mateusz\AppData\Roaming\MailUpdate => Moved successfully. "C:\Users\mateusz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk" => File/Directory not found. "C:\Users\mateusz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\San Andreas Multiplayer.lnk" => File/Directory not found. C:\Users\mateusz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Video Rotator.lnk => Moved successfully. C:\Users\mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Play Games Online.url => Moved successfully. C:\Users\mateusz\AppData\Roaming\OpenCandy => Moved successfully. C:\Users\mateusz\AppData\Roaming\Opera Software => Moved successfully. C:\Users\mateusz\AppData\Roaming\Origin\update.vbe => Moved successfully. C:\Users\mateusz\AppData\Roaming\SkypeFall => Moved successfully. C:\Users\mateusz\AppData\Roaming\SkypEmoticons => Moved successfully. "C:\Users\mateusz\Links\8 Ball Pool V10.lnk" => File/Directory not found. ========= reg delete HKCU\Software\Google /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Google /f ========= Bť¤D: System nie znalazˆ w rejestrze okre˜lonego klucza albo warto˜ci. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\Google /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= EmptyTemp: => Removed 3.5 GB temporary data. The system needed a reboot. ==== End of Fixlog 15:29:53 ====