Fix result of Farbar Recovery Scan Tool (x64) Version:28-06-2015 01 Ran by Szymon at 2015-07-02 13:32:05 Run:1 Running from E:\downloads Loaded Profiles: Szymon (Available Profiles: Szymon) Boot Mode: Normal ============================================== fixlist content: ***************** CloseProcesses: (Microsoft Corporation) C:\Windows\explorer.exe CreateRestorePoint: CustomCLSID: HKU\S-1-5-21-3972903673-1391813168-638966357-1000_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32 -> C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\atl.dll (rtrspocfMoa tonooiiCr) <==== ATTENTION R2 IHProtect Service; C:\Program Files (x86)\MiuiTab\ProtectService.exe [125056 2015-06-16] (XTab system) S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X] S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X] S3 MSICDSetup; \??\G:\CDriver64.sys [X] S3 NTIOLib_1_0_C; \??\G:\NTIOLib_X64.sys [X] S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X] Task: {91280A4C-14BC-4344-B7AE-CB29E2C25F8E} - System32\Tasks\{08D34113-C0E2-401E-99D4-0D25657C77E0} => pcalua.exe -a C:\Users\Szymon\AppData\Roaming\GameRanger\GameRanger\GameRanger.exe -c /uninstall Task: {BEE406F3-A0C9-4D27-A89D-CF8AC0E97746} - System32\Tasks\{276A7EF5-DF98-4D0F-BB66-3BC992EF7EAC} => pcalua.exe -a C:\Users\Szymon\AppData\Roaming\omiga-plus\UninstallManager.exe -c -ptid=smt <==== ATTENTION HKU\S-1-5-21-3972903673-1391813168-638966357-1000\...\MountPoints2: {18465afc-f614-11e4-8599-d43d7eb4708a} - J:\LG_PC_Programs.exe HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hppp&ts=1434543209&from=xtab&uid=B63D0C882ED54aedB2869013EEC0CF97 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hppp&ts=1434543209&from=xtab&uid=B63D0C882ED54aedB2869013EEC0CF97 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1423307037&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1423307037&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hppp&ts=1434543209&from=xtab&uid=B63D0C882ED54aedB2869013EEC0CF97 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hppp&ts=1434543209&from=xtab&uid=B63D0C882ED54aedB2869013EEC0CF97 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1423307037&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1423307037&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&q={searchTerms} HKU\S-1-5-21-3972903673-1391813168-638966357-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=dspp&ts=1423307065&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&q={searchTerms} HKU\S-1-5-21-3972903673-1391813168-638966357-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hppp&ts=1434543209&from=xtab&uid=B63D0C882ED54aedB2869013EEC0CF97 HKU\S-1-5-21-3972903673-1391813168-638966357-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hppp&ts=1434543209&from=xtab&uid=B63D0C882ED54aedB2869013EEC0CF97 HKU\S-1-5-21-3972903673-1391813168-638966357-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=dspp&ts=1423307065&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&q={searchTerms} SearchScopes: HKU\S-1-5-21-3972903673-1391813168-638966357-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&ts=1423307087&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3972903673-1391813168-638966357-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&ts=1423307087&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3972903673-1391813168-638966357-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&ts=1423307087&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3972903673-1391813168-638966357-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=dspp&ts=1434543209&from=xtab&uid=B63D0C882ED54aedB2869013EEC0CF97&q={searchTerms} SearchScopes: HKU\S-1-5-21-3972903673-1391813168-638966357-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&ts=1423307087&type=default&q={searchTerms} BHO-x32: LuckyTab Class -> {51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} -> C:\Program Files (x86)\MiuiTab\SupTab.dll [2015-06-16] (Thinknice Co. Limited) BHStartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe http://isearch.omiga-plus.com/?type=sc&ts=1423307037&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671 C:\Program Files (x86)\MiuiTab C:\Program Files (x86)\XTab C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8} C:\ProgramData\TEMP C:\Windows\system32\Drivers\*.tmp CMD: netsh advfirewall reset EmptyTemp: ***************** Processes closed successfully. [1592] C:\Windows\explorer.exe => process closed successfully. Restore point was successfully created. HKU\S-1-5-21-3972903673-1391813168-638966357-1000_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A} => key not found. IHProtect Service => Service not found. BRDriver64_1_3_3_E02B25FC => Service removed successfully EagleX64 => Service removed successfully MSICDSetup => Service removed successfully NTIOLib_1_0_C => Service removed successfully VBoxNetFlt => Service removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{91280A4C-14BC-4344-B7AE-CB29E2C25F8E}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{91280A4C-14BC-4344-B7AE-CB29E2C25F8E}" => key removed successfully C:\Windows\System32\Tasks\{08D34113-C0E2-401E-99D4-0D25657C77E0} => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{08D34113-C0E2-401E-99D4-0D25657C77E0}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BEE406F3-A0C9-4D27-A89D-CF8AC0E97746}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BEE406F3-A0C9-4D27-A89D-CF8AC0E97746}" => key removed successfully C:\Windows\System32\Tasks\{276A7EF5-DF98-4D0F-BB66-3BC992EF7EAC} => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{276A7EF5-DF98-4D0F-BB66-3BC992EF7EAC}" => key removed successfully "HKU\S-1-5-21-3972903673-1391813168-638966357-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{18465afc-f614-11e4-8599-d43d7eb4708a}" => key removed successfully HKCR\CLSID\{18465afc-f614-11e4-8599-d43d7eb4708a} => key not found. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully HKU\S-1-5-21-3972903673-1391813168-638966357-1000\Software\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully HKU\S-1-5-21-3972903673-1391813168-638966357-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKU\S-1-5-21-3972903673-1391813168-638966357-1000\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKU\S-1-5-21-3972903673-1391813168-638966357-1000\Software\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully HKU\S-1-5-21-3972903673-1391813168-638966357-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully HKU\S-1-5-21-3972903673-1391813168-638966357-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. HKU\S-1-5-21-3972903673-1391813168-638966357-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} => key not found. HKCR\CLSID\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} => key not found. HKU\S-1-5-21-3972903673-1391813168-638966357-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => key not found. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => key not found. HKU\S-1-5-21-3972903673-1391813168-638966357-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C} => key not found. HKCR\CLSID\{E733165D-CBCF-4FDA-883E-ADEF965B476C} => key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} => key not found. HKCR\Wow6432Node\CLSID\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} => key not found. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => value restored successfully "C:\Program Files (x86)\MiuiTab" => File/Folder not found. C:\Program Files (x86)\XTab => moved successfully. "C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}" => File/Folder not found. C:\ProgramData\TEMP => moved successfully. "C:\Windows\system32\Drivers\*.tmp" => File/Folder not found. ========= netsh advfirewall reset ========= Ok. ========= End of CMD: ========= EmptyTemp: => 2.8 GB temporary data Removed. The system needed a reboot.. ==== End of Fixlog 13:32:47 ====