Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 06-05-2015 01 Ran by Magda at 2015-05-07 18:44:47 Run:1 Running from C:\Documents and Settings\Magda\Pulpit Loaded Profiles: Magda & Gość (Available profiles: Magda & Gość) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: CreateRestorePoint: ShortcutWithArgument: C:\Documents and Settings\All Users\Menu Start\Programy\Google Chrome\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.mystartsearch.com/?type=sc&ts=1417288251&from=smt&uid=WDCXWD2500AAJS-07M0A0_WD-WMAV2C43209332093 ShortcutWithArgument: C:\Documents and Settings\Magda\Menu Start\Programy\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) -> hxxp://www.mystartsearch.com/?type=sc&ts=1417288251&from=smt&uid=WDCXWD2500AAJS-07M0A0_WD-WMAV2C43209332093 ShortcutWithArgument: C:\Documents and Settings\Magda\Menu Start\Programy\Akcesoria\Narzędzia systemowe\Internet Explorer (bez dodatków).lnk -> C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) -> hxxp://www.mystartsearch.com/?type=sc&ts=1417288251&from=smt&uid=WDCXWD2500AAJS-07M0A0_WD-WMAV2C43209332093 ShortcutWithArgument: C:\Documents and Settings\Magda\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Uruchom przeglądarkę Internet Explorer.lnk -> C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) -> hxxp://www.mystartsearch.com/?type=sc&ts=1417288251&from=smt&uid=WDCXWD2500AAJS-07M0A0_WD-WMAV2C43209332093 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sweet-page.com/?type=hp&ts=1428182986&from=cor&uid=WDCXWD2500AAJS-07M0A0_WD-WMAV2C43209332093 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1428182986&from=cor&uid=WDCXWD2500AAJS-07M0A0_WD-WMAV2C43209332093&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1428182986&from=cor&uid=WDCXWD2500AAJS-07M0A0_WD-WMAV2C43209332093 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1428182986&from=cor&uid=WDCXWD2500AAJS-07M0A0_WD-WMAV2C43209332093&q={searchTerms} HKU\S-1-5-21-1177238915-861567501-682003330-1003\Software\Microsoft\Internet Explorer\Main,Start Page = https://mysearch.avg.com/?cid={719FA3CE-D760-452D-A8C4-E62806492B4D}&mid=Unknown&lang=pl&ds=AVG&coid=avgtbavg&cmpid=0415avi&pr=fr&d=2015-05-04 10:06:32&v=4.1.0.411&pid=wtu&sg=&sap=hp HKU\S-1-5-21-1177238915-861567501-682003330-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1428182986&from=cor&uid=WDCXWD2500AAJS-07M0A0_WD-WMAV2C43209332093 SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1417288251&from=smt&uid=WDCXWD2500AAJS-07M0A0_WD-WMAV2C43209332093&q={searchTerms} SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1417288251&from=smt&uid=WDCXWD2500AAJS-07M0A0_WD-WMAV2C43209332093&q={searchTerms} SearchScopes: HKU\S-1-5-21-1177238915-861567501-682003330-1003 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1428182986&from=cor&uid=WDCXWD2500AAJS-07M0A0_WD-WMAV2C43209332093&q={searchTerms} SearchScopes: HKU\S-1-5-21-1177238915-861567501-682003330-1003 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={719FA3CE-D760-452D-A8C4-E62806492B4D}&mid=Unknown&lang=pl&ds=AVG&coid=avgtbavg&cmpid=0415avi&pr=fr&d=2015-05-04 10:06:32&v=4.1.0.411&pid=wtu&sg=&sap=dsp&q={searchTerms} SearchScopes: HKU\S-1-5-21-1177238915-861567501-682003330-1003 -> {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = http://www.daemon-search.com/search?q={searchTerms} Toolbar: HKLM - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File Toolbar: HKU\S-1-5-21-1177238915-861567501-682003330-1003 -> No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://isearch.omiga-plus.com/?type=sc&ts=1417288201&from=smt&uid=WDCXWD2500AAJS-07M0A0_WD-WMAV2C43209332093 StartMenuInternet: chrome.exe - C:\Program Files\Google\Chrome\Application\chrome.exe http://www.mystartsearch.com/?type=sc&ts=1417288251&from=smt&uid=WDCXWD2500AAJS-07M0A0_WD-WMAV2C43209332093 FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird StandardProfile\AuthorizedApplications: [C:\Program Files\KONAMI\Pro Evolution Soccer 2011\pes2011.exe] => Enabled:Pro Evolution Soccer 2011 StandardProfile\GloballyOpenPorts: [1886:TCP] => Enabled:Genieo U3 Avgfwfd; system32\DRIVERS\avgfwdx.sys [X] S3 FscBapi; system32\DRIVERS\FscBapi.sys [X] S3 FscCmos; system32\DRIVERS\FscCmos.sys [X] S3 FscCpuid; system32\DRIVERS\FscCpuid.sys [X] S3 FscEfDmi; system32\DRIVERS\FscEfDmi.sys [X] U3 a3mvpgbj; No ImagePath C:\Documents and Settings\All Users\Dane aplikacji\ALLPlayerRemote C:\Documents and Settings\All Users\Dane aplikacji\AVG Security Toolbar C:\Documents and Settings\All Users\Dane aplikacji\WindowsMangerProtect C:\Documents and Settings\Magda\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\WorldofTanks.lnk C:\Documents and Settings\Magda\Dane aplikacji\Opera Software C:\Documents and Settings\Magda\SendTo\Android (ALLPlayer Pilot).lnk C:\Documents and Settings\Magda\Ustawienia lokalne\Dane aplikacji\cache C:\Documents and Settings\Magda\Ustawienia lokalne\Dane aplikacji\Opera Software C:\Program Files\AVG Web TuneUp C:\Program Files\EnterDigital C:\Program Files\NapiProjekt C:\Program Files\Napisy24 C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ALLPlayer WiFi Remote" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ALLUpdate" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Napisy24Update" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DAEMON Tools Toolbar" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sweet-page uninstall" /f EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. C:\Documents and Settings\All Users\Menu Start\Programy\Google Chrome\Google Chrome.lnk => Shortcut argument was removed successfully. C:\Documents and Settings\Magda\Menu Start\Programy\Internet Explorer.lnk => Shortcut argument was removed successfully. C:\Documents and Settings\Magda\Menu Start\Programy\Akcesoria\Narzędzia systemowe\Internet Explorer (bez dodatków).lnk => Shortcut argument was restored successfully. C:\Documents and Settings\Magda\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Uruchom przeglądarkę Internet Explorer.lnk => Shortcut argument was removed successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKU\S-1-5-21-1177238915-861567501-682003330-1003\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKU\S-1-5-21-1177238915-861567501-682003330-1003\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. "HKU\S-1-5-21-1177238915-861567501-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. "HKU\S-1-5-21-1177238915-861567501-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}" => Key deleted successfully. HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key not found. "HKU\S-1-5-21-1177238915-861567501-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}" => Key deleted successfully. HKCR\CLSID\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} => Key not found. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{32099AAC-C132-4136-9E9A-4E364A424E17} => value deleted successfully. HKCR\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17} => Key not found. HKU\S-1-5-21-1177238915-861567501-682003330-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} => value deleted successfully. HKCR\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17} => Key not found. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. HKLM\Software\Mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b} => value deleted successfully. HKLM\Software\Mozilla\Thunderbird\Extensions\\eplgTb@eset.com => value deleted successfully. HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\KONAMI\Pro Evolution Soccer 2011\pes2011.exe => value deleted successfully. HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\1886:TCP => value deleted successfully. Avgfwfd => Error deleting Service FscBapi => Service deleted successfully. FscCmos => Service deleted successfully. FscCpuid => Service deleted successfully. FscEfDmi => Service deleted successfully. a3mvpgbj => Service not found. C:\Documents and Settings\All Users\Dane aplikacji\ALLPlayerRemote => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\AVG Security Toolbar => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\WindowsMangerProtect => Moved successfully. C:\Documents and Settings\Magda\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\WorldofTanks.lnk => Moved successfully. C:\Documents and Settings\Magda\Dane aplikacji\Opera Software => Moved successfully. C:\Documents and Settings\Magda\SendTo\Android (ALLPlayer Pilot).lnk => Moved successfully. C:\Documents and Settings\Magda\Ustawienia lokalne\Dane aplikacji\cache => Moved successfully. C:\Documents and Settings\Magda\Ustawienia lokalne\Dane aplikacji\Opera Software => Moved successfully. C:\Program Files\AVG Web TuneUp => Moved successfully. C:\Program Files\EnterDigital => Moved successfully. C:\Program Files\NapiProjekt => Moved successfully. C:\Program Files\Napisy24 => Moved successfully. C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension => Moved successfully. ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ALLPlayer WiFi Remote" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ALLUpdate" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Napisy24Update" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DAEMON Tools Toolbar" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sweet-page uninstall" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= EmptyTemp: => Removed 804 MB temporary data. The system needed a reboot. ==== End of Fixlog 18:46:47 ====