Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-04-2015 Ran by PiotrC at 2015-04-25 21:01:27 Run:1 Running from C:\Users\PiotrC\Downloads Loaded Profiles: PiotrC (Available profiles: PiotrC) Boot Mode: Normal ============================================== Content of fixlist: ***************** Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-2562658416-2256838758-2862498726-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION S3 Andbus; system32\DRIVERS\lgandbus64.sys [X] S3 AndDiag; system32\DRIVERS\lganddiag64.sys [X] S3 AndGps; system32\DRIVERS\lgandgps64.sys [X] S3 ANDModem; system32\DRIVERS\lgandmodem64.sys [X] S3 VGPU; System32\drivers\rdvgkmd.sys [X] C:\Users\PiotrC\Downloads\SpyHunter-Installer.exe C:\ProgramData\Yellow AdBlocker C:\Program Files (x86)\DiscountBomb C:\Program Files (x86)\AppendInit Folder: C:\ProgramData\{18722e4c-82fd-1f63-1872-22e4c82fb932} Folder: C:\ProgramData\{0b776249-34b3-9941-0b77-7624934b8924} Folder: C:\ProgramData\{bfc81d9b-c477-68ed-bfc8-81d9bc47766f} Folder: C:\ProgramData\{992954e7-a8f1-e719-9929-954e7a8f539e} EmptyTemp: ***************** ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= The operation completed successfully. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= The operation completed successfully. ========= End of Reg: ========= "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully. "HKU\S-1-5-21-2562658416-2256838758-2862498726-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully. Andbus => Service deleted successfully. AndDiag => Service deleted successfully. AndGps => Service deleted successfully. ANDModem => Service deleted successfully. VGPU => Service deleted successfully. C:\Users\PiotrC\Downloads\SpyHunter-Installer.exe => Moved successfully. C:\ProgramData\Yellow AdBlocker => Moved successfully. C:\Program Files (x86)\DiscountBomb => Moved successfully. C:\Program Files (x86)\AppendInit => Moved successfully. ========================= Folder: C:\ProgramData\{18722e4c-82fd-1f63-1872-22e4c82fb932} ======================== 2015-04-06 17:08 - 2015-04-06 17:08 - 0000000 _____ () C:\ProgramData\{18722e4c-82fd-1f63-1872-22e4c82fb932}\24a45f72df442319 2015-04-06 09:55 - 2015-04-06 09:55 - 0000900 _____ () C:\ProgramData\{18722e4c-82fd-1f63-1872-22e4c82fb932}\708.dat 2015-04-06 17:08 - 2015-04-06 17:08 - 0000000 _____ () C:\ProgramData\{18722e4c-82fd-1f63-1872-22e4c82fb932}\e959f927f890c4cd ====== End of Folder: ====== ========================= Folder: C:\ProgramData\{0b776249-34b3-9941-0b77-7624934b8924} ======================== 2015-04-07 08:07 - 2015-04-07 08:07 - 0000000 _____ () C:\ProgramData\{0b776249-34b3-9941-0b77-7624934b8924}\5bf2a5a6d5a8a58f 2015-04-06 09:55 - 2015-04-06 09:55 - 0000900 _____ () C:\ProgramData\{0b776249-34b3-9941-0b77-7624934b8924}\950.dat 2015-04-07 08:07 - 2015-04-11 15:44 - 0000042 _____ () C:\ProgramData\{0b776249-34b3-9941-0b77-7624934b8924}\960f03f3f27c425b ====== End of Folder: ====== ========================= Folder: C:\ProgramData\{bfc81d9b-c477-68ed-bfc8-81d9bc47766f} ======================== 2015-03-29 18:43 - 2015-03-29 18:43 - 0000000 _____ () C:\ProgramData\{bfc81d9b-c477-68ed-bfc8-81d9bc47766f}\5fbf3bcd4a828c16 2015-03-29 18:43 - 2015-04-11 15:43 - 0000042 _____ () C:\ProgramData\{bfc81d9b-c477-68ed-bfc8-81d9bc47766f}\92429d986d566bc2 2015-03-29 18:34 - 2015-03-29 18:34 - 0000898 _____ () C:\ProgramData\{bfc81d9b-c477-68ed-bfc8-81d9bc47766f}\E70.dat ====== End of Folder: ====== ========================= Folder: C:\ProgramData\{992954e7-a8f1-e719-9929-954e7a8f539e} ======================== 2015-03-28 20:16 - 2015-03-28 20:16 - 0000000 _____ () C:\ProgramData\{992954e7-a8f1-e719-9929-954e7a8f539e}\353afd456e683903 2015-03-28 13:41 - 2015-03-28 13:41 - 0000892 _____ () C:\ProgramData\{992954e7-a8f1-e719-9929-954e7a8f539e}\Download The Forest v0.14 (Windows) _ VIruz Torrent - KickassTorrents.dat 2015-03-28 20:16 - 2015-03-28 20:16 - 0000000 _____ () C:\ProgramData\{992954e7-a8f1-e719-9929-954e7a8f539e}\f8c75b1049bcded7 ====== End of Folder: ====== EmptyTemp: => Removed 4.8 MB temporary data. The system needed a reboot. ==== End of Fixlog 21:01:28 ====