Fix result of Farbar Recovery Scan Tool (x64) Version: 22-05-2015 01 Ran by Winiarska Janina at 2015-05-26 18:02:36 Run:1 Running from C:\Users\Winiarska Janina\Desktop Loaded Profiles: UpdatusUser & Winiarska Janina (Available Profiles: UpdatusUser & Winiarska Janina) Boot Mode: Normal ============================================== fixlist content: ***************** CloseProcesses: CreateRestorePoint: AppInit_DLLs-x32: C:\PROGRA~3\{F0231~1\1170~1.1\miti.dll => C:\ProgramData\{F02318E0-A0A1-C966-1127-B9E4C1A56A6A}\1.17.0.1\miti.dll [778752 2015-05-15] () Task: {94E8CA91-F0BA-4ACA-B2B9-C7E99B6CFA17} - System32\Tasks\Dregol miti => C:\ProgramData\{F02318E0-A0A1-C966-1127-B9E4C1A56A6A}\1.17.0.1\f Task: {273EF470-4FBB-4188-8116-7A07FBFD450E} - System32\Tasks\{83A83583-4ECC-4CA6-9DFE-41978A190351} => Firefox.exe http://ui.skype.com/ui/0/6.18.60.106/pl/abandoninstall?page=tsProgressBar Task: {8F3389A4-D481-4160-9A7F-A93D9E6DFA12} - System32\Tasks\{7FEE00B2-37E4-4217-A5AB-10716E14118C} => Firefox.exe http://ui.skype.com/ui/0/6.20.0.104/pl/abandoninstall?page=tsPlugin GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION CHR HKLM\...\Chrome\Extension: [ihokndmjeombjojnfkmapfnjeghjohim] - https://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-392818877-1939927122-1532879338-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ihokndmjeombjojnfkmapfnjeghjohim] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [ihokndmjeombjojnfkmapfnjeghjohim] - https://clients2.google.com/service/update2/crx HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKU\S-1-5-21-392818877-1939927122-1532879338-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-392818877-1939927122-1532879338-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage HKU\S-1-5-21-392818877-1939927122-1532879338-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm HKU\S-1-5-21-392818877-1939927122-1532879338-1001\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms} HKU\S-1-5-21-392818877-1939927122-1532879338-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006 HKU\S-1-5-21-392818877-1939927122-1532879338-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006 SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms} SearchScopes: HKU\S-1-5-21-392818877-1939927122-1532879338-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms} Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKU\S-1-5-21-392818877-1939927122-1532879338-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File StartMenuInternet: IEXPLORE.EXE - iexplore.exe C:\ProgramData\{F02318E0-A0A1-C966-1127-B9E4C1A56A6A} C:\Users\Winiarska Janina\AppData\Local\{90FBD4E5-F418-471B-9BEC-9A08B2186E97} C:\Users\Winiarska Janina\AppData\Local\Chromium C:\windows\system32\Drivers\etc\hosts.*.backup Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains" /f Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main" /f Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f Hosts: EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. "C:\PROGRA~3\{F0231~1\1170~1.1\miti.dll" => Value Data Removed successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{94E8CA91-F0BA-4ACA-B2B9-C7E99B6CFA17}" => key Removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{94E8CA91-F0BA-4ACA-B2B9-C7E99B6CFA17}" => key Removed successfully C:\Windows\System32\Tasks\Dregol miti => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Dregol miti" => key Removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{273EF470-4FBB-4188-8116-7A07FBFD450E}" => key Removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{273EF470-4FBB-4188-8116-7A07FBFD450E}" => key Removed successfully C:\Windows\System32\Tasks\{83A83583-4ECC-4CA6-9DFE-41978A190351} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{83A83583-4ECC-4CA6-9DFE-41978A190351}" => key Removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8F3389A4-D481-4160-9A7F-A93D9E6DFA12}" => key Removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8F3389A4-D481-4160-9A7F-A93D9E6DFA12}" => key Removed successfully C:\Windows\System32\Tasks\{7FEE00B2-37E4-4217-A5AB-10716E14118C} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{7FEE00B2-37E4-4217-A5AB-10716E14118C}" => key Removed successfully C:\windows\system32\GroupPolicy\Machine => Moved successfully. C:\windows\system32\GroupPolicy\GPT.ini => Moved successfully. "HKLM\SOFTWARE\Policies\Google" => key Removed successfully "HKLM\SOFTWARE\Google\Chrome\Extensions\ihokndmjeombjojnfkmapfnjeghjohim" => key Removed successfully "HKU\S-1-5-21-392818877-1939927122-1532879338-1001\SOFTWARE\Google\Chrome\Extensions\ihokndmjeombjojnfkmapfnjeghjohim" => key Removed successfully "HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ihokndmjeombjojnfkmapfnjeghjohim" => key Removed successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value restored successfully HKU\S-1-5-21-392818877-1939927122-1532879338-1000\Software\Microsoft\Internet Explorer\Main\\Search Page => Error setting value. HKU\S-1-5-21-392818877-1939927122-1532879338-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => Error setting value. HKU\S-1-5-21-392818877-1939927122-1532879338-1000\Software\Microsoft\Internet Explorer\Main\\Search Bar => Value not found. HKU\S-1-5-21-392818877-1939927122-1532879338-1001\Software\Microsoft\Internet Explorer\Main\\Search Page => Value restored successfully HKU\S-1-5-21-392818877-1939927122-1532879338-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => Value restored successfully HKU\S-1-5-21-392818877-1939927122-1532879338-1001\Software\Microsoft\Internet Explorer\Main\\Search Bar => value Removed successfully "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}" => key Removed successfully HKCR\Wow6432Node\CLSID\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F} => key not found. "HKU\S-1-5-21-392818877-1939927122-1532879338-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}" => key Removed successfully HKCR\CLSID\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F} => key not found. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} => value Removed successfully "HKCR\CLSID\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}" => key Removed successfully HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => value Removed successfully HKCR\CLSID\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => key not found. HKU\S-1-5-21-392818877-1939927122-1532879338-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value Removed successfully HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => key not found. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value restored successfully C:\ProgramData\{F02318E0-A0A1-C966-1127-B9E4C1A56A6A} => Moved successfully. C:\Users\Winiarska Janina\AppData\Local\{90FBD4E5-F418-471B-9BEC-9A08B2186E97} => Moved successfully. C:\Users\Winiarska Janina\AppData\Local\Chromium => Moved successfully. C:\windows\system32\Drivers\etc\hosts.*.backup => Moved successfully. ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main" /f ========= Bť¤D: System nie znalazˆ w rejestrze okre˜lonego klucza albo warto˜ci. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= C:\Windows\System32\Drivers\etc\hosts => Moved successfully. Hosts restored successfully. EmptyTemp: => Removed 282 MB temporary data. The system needed a reboot. ==== End of Fixlog 18:04:31 ====