Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 06-05-2015 01 Ran by Basia at 2015-05-07 18:01:33 Run:2 Running from C:\Users\Basia\Downloads\usuwanie adware-programy Loaded Profiles: Basia (Available profiles: Basia & Administrator) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: CreateRestorePoint: Startup: C:\Users\Basia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pokemon - Yellow Version (UE) [C][!].lnk [2015-03-26] HKU\S-1-5-21-3765252679-2603235602-2670530523-1002\...\Run: [GoogleChromeAutoLaunch_0E2B99A387FEFAF01C3E37F02023327D] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [812872 2015-04-28] (Google Inc.) HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey HKLM\...\Policies\Explorer: [NoFolderOptions] 0 HKLM\...\Policies\Explorer: [NoControlPanel] 0 HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""="" S1 MpKsl96363f73; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E441C063-7055-4608-BF7D-55D054DE342C}\MpKsl96363f73.sys [X] Task: {40AE40D5-17F9-43A1-80FB-B957167F7AC5} - System32\Tasks\{9B046CCB-664A-4DE5-91E4-FC6CF5A1F6DE} => Chrome.exe http://ui.skype.com/ui/0/7.0.0.102/en/abandoninstall?page=tsMain HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com SearchScopes: HKU\S-1-5-21-3765252679-2603235602-2670530523-1002 -> DefaultScope {7B888875-3611-474C-8EF8-A5B3E7D10C50} URL = SearchScopes: HKU\S-1-5-21-3765252679-2603235602-2670530523-1002 -> {7B888875-3611-474C-8EF8-A5B3E7D10C50} URL = DPF: HKLM-x32 {4FF78044-96B4-4312-A5B7-FDA3CB328095} C:\Program Files (x86)\Google\Chrome C:\Program Files (x86)\Mozilla Firefox C:\ProgramData\{9082fcfb-4363-3bb3-9082-2fcfb436f3ed} C:\Users\Basia\AppData\Local\Temp-log.txt C:\Users\Basia\AppData\Local\Google\Chrome C:\Users\Basia\AppData\Local\Mozilla C:\Users\Basia\AppData\Roaming\Mozilla C:\Users\Basia\AppData\Roaming\appdataFr3.bin C:\Users\Basia\Desktop\Kuciak\gry\Battlefield 3.lnk C:\Users\Basia\Desktop\Kuciak\gry\Europa Universalis IV.lnk C:\Users\Basia\Desktop\Kuciak\gry\Plants vs. Zombies.lnk C:\Users\Basia\Desktop\Kuciak\gry\The Sims 2 Ultimate Collection.lnk C:\Users\Basia\Desktop\programy\ALLPlayer*.lnk C:\Users\Basia\Desktop\programy\Avast*.lnk C:\Users\Basia\Desktop\programy\Cyberlink Power2Go.lnk C:\Users\Basia\Desktop\programy\DAEMON Tools Lite.lnk C:\Users\Basia\Desktop\programy\Dropbox.lnk C:\Users\Basia\Desktop\programy\IrfanView.lnk C:\Users\Basia\Desktop\programy\NapiProjekt.lnk C:\Users\Basia\Desktop\programy\Origin.lnk C:\Users\Basia\Desktop\programy\RAPTOR.lnk C:\Users\Basia\Desktop\programy\Shortcut to SecureDownloadManager.exe.lnk C:\Users\Basia\Desktop\programy\Sony PC Companion 2.1.lnk C:\Users\Basia\Desktop\Programy systemowe\McAfee Internet Security.lnk Reg: reg delete HKCU\Software\Google\Chrome /f Reg: reg delete HKCU\Software\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D} /f Reg: reg delete HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96} /f Reg: reg delete HKCU\Software\Mozilla /f Reg: reg delete HKCU\Software\MozillaPlugins /f Reg: reg delete HKLM\SOFTWARE\Mozilla /f Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D} /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96} /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\mozilla.org /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f CMD: netsh advfirewall reset EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. C:\Users\Basia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pokemon - Yellow Version (UE) not found. HKU\S-1-5-21-3765252679-2603235602-2670530523-1002\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_0E2B99A387FEFAF01C3E37F02023327D => Value not found. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\mcui_exe => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoFolderOptions => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoControlPanel => value deleted successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc" => Key deleted successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc" => Key deleted successfully. MpKsl96363f73 => Service deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{40AE40D5-17F9-43A1-80FB-B957167F7AC5}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{40AE40D5-17F9-43A1-80FB-B957167F7AC5}" => Key deleted successfully. C:\Windows\System32\Tasks\{9B046CCB-664A-4DE5-91E4-FC6CF5A1F6DE} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{9B046CCB-664A-4DE5-91E4-FC6CF5A1F6DE}" => Key deleted successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKU\S-1-5-21-3765252679-2603235602-2670530523-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully. "HKU\S-1-5-21-3765252679-2603235602-2670530523-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7B888875-3611-474C-8EF8-A5B3E7D10C50}" => Key deleted successfully. HKCR\CLSID\{7B888875-3611-474C-8EF8-A5B3E7D10C50} => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}" => Key deleted successfully. HKCR\Wow6432Node\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095} => Key not found. "C:\Program Files (x86)\Google\Chrome" => File/Directory not found. C:\Program Files (x86)\Mozilla Firefox => Moved successfully. "C:\ProgramData\{9082fcfb-4363-3bb3-9082-2fcfb436f3ed}" => File/Directory not found. C:\Users\Basia\AppData\Local\Temp-log.txt => Moved successfully. "C:\Users\Basia\AppData\Local\Google\Chrome" => File/Directory not found. C:\Users\Basia\AppData\Local\Mozilla => Moved successfully. C:\Users\Basia\AppData\Roaming\Mozilla => Moved successfully. C:\Users\Basia\AppData\Roaming\appdataFr3.bin => Moved successfully. C:\Users\Basia\Desktop\Kuciak\gry\Battlefield 3.lnk => Moved successfully. "C:\Users\Basia\Desktop\Kuciak\gry\Europa Universalis IV.lnk" => File/Directory not found. "C:\Users\Basia\Desktop\Kuciak\gry\Plants vs. Zombies.lnk" => File/Directory not found. "C:\Users\Basia\Desktop\Kuciak\gry\The Sims 2 Ultimate Collection.lnk" => File/Directory not found. C:\Users\Basia\Desktop\programy\ALLPlayer*.lnk => Moved successfully. C:\Users\Basia\Desktop\programy\Avast*.lnk => Moved successfully. C:\Users\Basia\Desktop\programy\Cyberlink Power2Go.lnk => Moved successfully. C:\Users\Basia\Desktop\programy\DAEMON Tools Lite.lnk => Moved successfully. C:\Users\Basia\Desktop\programy\Dropbox.lnk => Moved successfully. C:\Users\Basia\Desktop\programy\IrfanView.lnk => Moved successfully. C:\Users\Basia\Desktop\programy\NapiProjekt.lnk => Moved successfully. C:\Users\Basia\Desktop\programy\Origin.lnk => Moved successfully. C:\Users\Basia\Desktop\programy\RAPTOR.lnk => Moved successfully. C:\Users\Basia\Desktop\programy\Shortcut to SecureDownloadManager.exe.lnk => Moved successfully. C:\Users\Basia\Desktop\programy\Sony PC Companion 2.1.lnk => Moved successfully. C:\Users\Basia\Desktop\Programy systemowe\McAfee Internet Security.lnk => Moved successfully. ========= reg delete HKCU\Software\Google\Chrome /f ========= Operacja ukonczona pomyslnie. ========= End of Reg: ========= ========= reg delete HKCU\Software\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D} /f ========= Operacja ukonczona pomyslnie. ========= End of Reg: ========= ========= reg delete HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96} /f ========= Operacja ukonczona pomyslnie. ========= End of Reg: ========= ========= reg delete HKCU\Software\Mozilla /f ========= Operacja ukonczona pomyslnie. ========= End of Reg: ========= ========= reg delete HKCU\Software\MozillaPlugins /f ========= Operacja ukonczona pomyslnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Mozilla /f ========= Operacja ukonczona pomyslnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\MozillaPlugins /f ========= Operacja ukonczona pomyslnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D} /f ========= ERROR: The system was unable to find the specified registry key or value. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96} /f ========= ERROR: The system was unable to find the specified registry key or value. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f ========= Operacja ukonczona pomyslnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\mozilla.org /f ========= Operacja ukonczona pomyslnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f ========= Operacja ukonczona pomyslnie. ========= End of Reg: ========= ========= netsh advfirewall reset ========= Ok. ========= End of CMD: ========= EmptyTemp: => Removed 48 MB temporary data. The system needed a reboot. ==== End of Fixlog 18:03:40 ====