Fix result of Farbar Recovery Scan Tool (x64) Version:21-06-2015 01 Ran by Ola at 2015-06-24 22:14:27 Run:1 Running from C:\Users\Ola\Desktop Loaded Profiles: Ola (Available Profiles: Ola) Boot Mode: Safe Mode (minimal) ============================================== fixlist content: ***************** DisableService: VSSS HKLM-x32\...\Run: [TaskTray] => [X] Task: {3B1039D2-C7C9-4E40-B837-4EC757365118} - System32\Tasks\{6A8B768F-F083-40B1-836F-C0593A6F7036} => pcalua.exe -a C:\Windows\SysWOW64\Samsung_USB_Drivers\2\SSM_Uninstall.exe Task: {64D5FEE5-226B-4BB7-8F84-6534E66AE29E} - System32\Tasks\{E187F430-7B35-4A1A-AE6D-046292D2C464} => pcalua.exe -a C:\Windows\SysWOW64\Samsung_USB_Drivers\5\SSSDUninstall.exe Task: {6E8B6CAF-3F8C-4102-BFC2-C8D272673125} - System32\Tasks\{CBF18997-2AED-4BBC-A0A7-BDE79C1709B4} => C:\Program Files (x86)\Skype\\Phone\Skype.exe Task: {A8FD0B9A-7BD2-477D-9B7D-02CDDB7F7E8D} - System32\Tasks\{6BAB1883-5FF8-43B6-980F-F1E0700EC112} => pcalua.exe -a C:\Users\Ola\AppData\Roaming\omiga-plus\UninstallManager.exe -c -ptid=cor <==== ATTENTION Task: {C2006566-8FF7-42F7-A069-E8E67E9E088C} - System32\Tasks\{F3BEEA16-6920-434F-ACB3-2A5D46C76928} => E:\Install.exe Task: {C78DD98D-4740-41A4-BC17-6E583F2E07AF} - System32\Tasks\{D8A5CD5D-4746-408A-88B5-E79D10FB5B11} => pcalua.exe -a E:\Setup.exe -d E:\ Task: {D0BB8E73-0E0C-41E3-A4EF-9949CC60F046} - System32\Tasks\{A562F978-FCA7-4A48-9546-50874C9FEB78} => Firefox.exe http://ui.skype.com/ui/0/5.3.0.120.259/pl/abandoninstall?source=lightinstaller&page=tsDownload&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;systemlevelpresent Task: {F310FE67-9D68-401D-8F9A-3015F9025055} - System32\Tasks\{62B8DF6A-F8D0-4B3E-893E-CB533BFF500C} => C:\Program Files (x86)\Skype\\Phone\Skype.exe HKLM\...\Policies\Explorer: [TaskbarNoNotification] 1 HKLM\...\Policies\Explorer: [HideSCAHealth] 1 HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE -> HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE -> HKU\S-1-5-21-1365672938-4047589735-543654078-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com BHO-x32: Winamp Toolbar Loader -> {4accc990-3dc7-4456-a734-5cb4b610a7f5} -> C:\Program Files (x86)\Winamp Toolbar\winamppltb.dll No File Toolbar: HKLM-x32 - Winamp Toolbar - {a0b1221c-a3ff-4f7c-a393-dc63af5301e9} - C:\Program Files (x86)\Winamp Toolbar\winamppltb.dll No File FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF HKU\S-1-5-21-1365672938-4047589735-543654078-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 C:\Program Files (x86)\mozilla firefox\plugins C:\Program Files\*.exe C:\Users\Ola\*.exe C:\Users\Ola\AppData\Roaming\obthqktxba.exe Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f Reboot: ***************** VSSS service was disabled HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\TaskTray => value removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3B1039D2-C7C9-4E40-B837-4EC757365118}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3B1039D2-C7C9-4E40-B837-4EC757365118}" => key removed successfully C:\Windows\System32\Tasks\{6A8B768F-F083-40B1-836F-C0593A6F7036} => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6A8B768F-F083-40B1-836F-C0593A6F7036}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{64D5FEE5-226B-4BB7-8F84-6534E66AE29E}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{64D5FEE5-226B-4BB7-8F84-6534E66AE29E}" => key removed successfully C:\Windows\System32\Tasks\{E187F430-7B35-4A1A-AE6D-046292D2C464} => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{E187F430-7B35-4A1A-AE6D-046292D2C464}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6E8B6CAF-3F8C-4102-BFC2-C8D272673125}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6E8B6CAF-3F8C-4102-BFC2-C8D272673125}" => key removed successfully C:\Windows\System32\Tasks\{CBF18997-2AED-4BBC-A0A7-BDE79C1709B4} => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{CBF18997-2AED-4BBC-A0A7-BDE79C1709B4}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A8FD0B9A-7BD2-477D-9B7D-02CDDB7F7E8D}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A8FD0B9A-7BD2-477D-9B7D-02CDDB7F7E8D}" => key removed successfully C:\Windows\System32\Tasks\{6BAB1883-5FF8-43B6-980F-F1E0700EC112} => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6BAB1883-5FF8-43B6-980F-F1E0700EC112}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C2006566-8FF7-42F7-A069-E8E67E9E088C}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C2006566-8FF7-42F7-A069-E8E67E9E088C}" => key removed successfully C:\Windows\System32\Tasks\{F3BEEA16-6920-434F-ACB3-2A5D46C76928} => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{F3BEEA16-6920-434F-ACB3-2A5D46C76928}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C78DD98D-4740-41A4-BC17-6E583F2E07AF}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C78DD98D-4740-41A4-BC17-6E583F2E07AF}" => key removed successfully C:\Windows\System32\Tasks\{D8A5CD5D-4746-408A-88B5-E79D10FB5B11} => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{D8A5CD5D-4746-408A-88B5-E79D10FB5B11}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D0BB8E73-0E0C-41E3-A4EF-9949CC60F046}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D0BB8E73-0E0C-41E3-A4EF-9949CC60F046}" => key removed successfully C:\Windows\System32\Tasks\{A562F978-FCA7-4A48-9546-50874C9FEB78} => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A562F978-FCA7-4A48-9546-50874C9FEB78}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F310FE67-9D68-401D-8F9A-3015F9025055}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F310FE67-9D68-401D-8F9A-3015F9025055}" => key removed successfully C:\Windows\System32\Tasks\{62B8DF6A-F8D0-4B3E-893E-CB533BFF500C} => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{62B8DF6A-F8D0-4B3E-893E-CB533BFF500C}" => key removed successfully HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\TaskbarNoNotification => value removed successfully HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\HideSCAHealth => value removed successfully HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE => value removed successfully HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE => value removed successfully HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE => value removed successfully HKU\S-1-5-21-1365672938-4047589735-543654078-1000\Control Panel\Desktop\\SCRNSAVE.EXE => value removed successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4accc990-3dc7-4456-a734-5cb4b610a7f5}" => key removed successfully "HKCR\Wow6432Node\CLSID\{4accc990-3dc7-4456-a734-5cb4b610a7f5}" => key removed successfully HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{a0b1221c-a3ff-4f7c-a393-dc63af5301e9} => value removed successfully "HKCR\Wow6432Node\CLSID\{a0b1221c-a3ff-4f7c-a393-dc63af5301e9}" => key removed successfully HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\smartwebprinting@hp.com => value removed successfully HKU\S-1-5-21-1365672938-4047589735-543654078-1000\Software\Mozilla\Firefox\Extensions\\smartwebprinting@hp.com => value removed successfully C:\Program Files (x86)\mozilla firefox\plugins => moved successfully. C:\Program Files\*.exe => moved successfully. C:\Users\Ola\*.exe => moved successfully. C:\Users\Ola\AppData\Roaming\obthqktxba.exe => moved successfully. ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= The system needed a reboot.. ==== End of Fixlog 22:14:28 ====