Fix result of Farbar Recovery Scan Tool (x64) Version:12-07-2015 Ran by Gosia at 2015-07-13 13:59:36 Run:1 Running from C:\Users\Gosia\Downloads Loaded Profiles: Gosia (Available Profiles: Gosia) Boot Mode: Normal ============================================== fixlist content: ***************** CloseProcesses: CreateRestorePoint: R1 wafd_1_10_0_19; C:\Windows\System32\drivers\wafd_1_10_0_19.sys [61312 2015-06-16] (WA) S2 wasvc_1.10.0.19; "C:\Program Files (x86)\WordAnchor_1.10.0.19\Service\wasvc.exe" [X] HKLM\...\Run: [] => [X] Startup: C:\Users\Gosia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t.lnk [2015-06-07] GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-06-13] Task: {85176E1D-EFA0-4099-ABA4-3038072167AC} - System32\Tasks\Opera N Sunday => C:\Program Files (x86)\Opera\launcher.exe Task: {FA4755F3-56EE-40D9-9F16-FCB829A23697} - System32\Tasks\Opera N Saturday => C:\Program Files (x86)\Opera\launcher.exe C:\Program Files (x86)\Opera C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3 C:\Users\Gosia\AppData\Local\Opera Software C:\Users\Gosia\AppData\Roaming\Opera Software C:\Users\Gosia\AppData\Roaming\GoldenGate C:\Users\Gosia\AppData\Roaming\Shortcut C:\Windows\System32\drivers\wafd_1_10_0_19.sys Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. wafd_1_10_0_19 => Unable to stop service. wafd_1_10_0_19 => Service removed successfully wasvc_1.10.0.19 => Service removed successfully HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully C:\Users\Gosia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t.lnk => moved successfully. C:\windows\system32\GroupPolicy\Machine => moved successfully. C:\windows\system32\GroupPolicy\GPT.ini => moved successfully. "HKLM\SOFTWARE\Policies\Google" => key removed successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully "HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\eofcbnmajmjmplflapaojjnihcjkigck" => key removed successfully Could not move "C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx" => Scheduled to move on reboot. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{85176E1D-EFA0-4099-ABA4-3038072167AC}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{85176E1D-EFA0-4099-ABA4-3038072167AC}" => key removed successfully C:\Windows\System32\Tasks\Opera N Sunday => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Opera N Sunday" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FA4755F3-56EE-40D9-9F16-FCB829A23697}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FA4755F3-56EE-40D9-9F16-FCB829A23697}" => key removed successfully C:\Windows\System32\Tasks\Opera N Saturday => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Opera N Saturday" => key removed successfully C:\Program Files (x86)\Opera => moved successfully. C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3 => moved successfully. C:\Users\Gosia\AppData\Local\Opera Software => moved successfully. C:\Users\Gosia\AppData\Roaming\Opera Software => moved successfully. C:\Users\Gosia\AppData\Roaming\GoldenGate => moved successfully. C:\Users\Gosia\AppData\Roaming\Shortcut => moved successfully. C:\Windows\System32\drivers\wafd_1_10_0_19.sys => moved successfully. ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= EmptyTemp: => 2.7 GB temporary data Removed. Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2015-07-13 14:02:47)<= "C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx" => Could not move ==== End of Fixlog 14:02:47 ====