Fix result of Farbar Recovery Scan Tool (x64) Version: 08-05-2017 Ran by paulinka (14-05-2017 14:59:36) Run:1 Running from C:\Users\paulinka\Desktop Loaded Profiles: paulinka (Available Profiles: paulinka) Boot Mode: Normal ============================================== fixlist content: ***************** CloseProcesses: CreateRestorePoint: CustomCLSID: HKU\S-1-5-21-1822749172-3988503527-1915266406-1000_Classes\CLSID\{00000001-0E3A-4123-8B32-4B68A91E104A}\InprocServer32 -> C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIBasePlace.dll => No File Task: {813CC27D-1124-4CFE-A7A9-1BF8D640A797} - System32\Tasks\DigitalSite => C:\Users\paulinka\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION Task: C:\Windows\Tasks\DigitalSite.job => C:\Users\paulinka\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION C:\Users\paulinka\AppData\Roaming\DIGITA~1 ShortcutWithArgument: C:\Users\paulinka\AppData\Local\Google\Chrome\User Data\Program uruchamiajacy aplikacje Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --show-app-list ShortcutWithArgument: C:\Users\paulinka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Program uruchamiajacy aplikacje Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --show-app-list HKLM-x32\...\Run: [fst_gb_13] => [X] AppInit_DLLs: c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll => No File AppInit_DLLs: c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll => No File c:\progra~3\bitguard CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION URLSearchHook: HKU\S-1-5-21-1822749172-3988503527-1915266406-1000 - (No Name) - {50fafaf0-70a9-419d-a109-fa4b4ffd4e37} - No File SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1822749172-3988503527-1915266406-1000 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = BHO-x32: WinZip Courier BHO -> {A8FB70FA-0FDF-4601-9DC4-BFA1B357204F} -> C:\PROGRA~2\WINZIP~2\wzwmcie.dll => No File Toolbar: HKU\S-1-5-21-1822749172-3988503527-1915266406-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKU\S-1-5-21-1822749172-3988503527-1915266406-1000 -> No Name - {50FAFAF0-70A9-419D-A109-FA4B4FFD4E37} - No File SearchScopes: HKU\S-1-5-21-1822749172-3988503527-1915266406-1000 -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = hxxp://speedial.com/results.php?f=4&q={searchTerms}&a=spd_wnzp_14_23_ch&cd=2XzuyEtN2Y1L1Qzu0Ezzzy0Azz0F0Bzy0FyBtDyCzyyC0B0EtN0D0Tzu0SzzzzzytN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0D0D0E0A0D0BtG0Bzzzy0DtGyEyCyD0CtGyC0D0C0CtGyE0DyCyByE0FyCzytByCzz0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0D0CyDzz0DyCtBtG0Czy0ByEtGyB0C0E0AtGtCtDyC0AtGyB0FyB0F0C0BtDtDzzyEyCyC2QtN1B1L1H1E SearchScopes: HKU\S-1-5-21-1822749172-3988503527-1915266406-1000 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = SearchScopes: HKU\S-1-5-21-1822749172-3988503527-1915266406-1000 -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites03_14_20_ch&cd=2XzuyEtN2Y1L1Qzu0Ezzzy0Azz0F0Bzy0FyBtDyCzyyC0B0EtN0D0Tzu0SzzyCzztN1L2XzutBtFtBtDtFtCtAtFtDtN1L1CzutCyEtDtAtDyD1V1OtN1L1G1B1V1N2Y1L1Qzu2SyE0E0C0EtD0CtAtCtGyBtA0B0FtGtA0Fzz0AtGtBzytDtDtGyBzytCyEzytByD0FtCyB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0D0CyDzz0DyCtBtG0Czy0ByEtGyB0C0E0AtGtCtDyC0AtGyB0FyB0F0C0BtDtDzzyEyCyC2Q&cr=1276797276&ir= SearchScopes: HKU\S-1-5-21-1822749172-3988503527-1915266406-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=121150&babsrc=SP_ss&mntrId=6e7a96be00000000000074de2b037416 SearchScopes: HKU\S-1-5-21-1822749172-3988503527-1915266406-1000 -> {213BD86A-D8DE-47C7-AA9A-CF771C6850EF} URL = hxxps://uk.search.yahoo.com/search?fr=mcafee&type=C011GB91020D20150313&p={searchTerms} SearchScopes: HKLM -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = hxxp://speedial.com/results.php?f=4&q={searchTerms}&a=spd_wnzp_14_23_ch&cd=2XzuyEtN2Y1L1Qzu0Ezzzy0Azz0F0Bzy0FyBtDyCzyyC0B0EtN0D0Tzu0SzzzzzytN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0D0D0E0A0D0BtG0Bzzzy0DtGyEyCyD0CtGyC0D0C0CtGyE0DyCyByE0FyCzytByCzz0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0D0CyDzz0DyCtBtG0Czy0ByEtGyB0C0E0AtGtCtDyC0AtGyB0FyB0F0C0BtDtDzzyEyCyC2QtN1B1L1H1Ezu1O2U1M1B&cr=2116844849&ir= SearchScopes: HKLM -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites03_14_20_ch&cd=2XzuyEtN2Y1L1Qzu0Ezzzy0Azz0F0Bzy0FyBtDyCzyyC0B0EtN0D0Tzu0SzzyCzztN1L2XzutBtFtBtDtFtCtAtFtDtN1L1CzutCyEtDtAtDyD1V1OtN1L1G1B1V1N2Y1L1Qzu2SyE0E0C0EtD0CtAtCtGyBtA0B0FtGtA0Fzz0AtGtBzytDtDtGyBzytCyEzytByD0FtCyB0CtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0D0CyDzz0DyCtBtG0Czy0ByEtGyB0C0E0AtGtCtDyC0AtGyB0FyB0F0C0BtDtDzzyEyCyC2Q&cr=1276797276&ir= CHR Extension: (MySearchDial) - C:\Users\paulinka\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\iagcajndpnfncplednpbnkahadegklfa [2017-05-08] StartMenuInternet: Google Chrome.R7UGBHHLDKADMYR2SRVGFTQTX4 - C:\Users\paulinka\AppData\Local\Google\Chrome\Application\chrome.exe S2 SupportSoft RemoteAssist; C:\Program Files (x86)\Common Files\supportsoft\bin\ssrc.exe [X] S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X] S3 RSUSBVSTOR; System32\Drivers\RTSUVSTOR.sys [X] DeleteKey: HKCU\Software\Mozilla DeleteKey: HKCU\Software\MozillaPlugins DeleteKey: HKLM\SOFTWARE\Mozilla DeleteKey: HKLM\SOFTWARE\MozillaPlugins DeleteKey: HKLM\SOFTWARE\Wow6432Node\Mozilla DeleteKey: HKLM\SOFTWARE\Wow6432Node\mozilla.org DeleteKey: HKLM\SOFTWARE\Wow6432Node\MozillaPlugins C:\Users\Stefan\AppData\Local\Mozilla C:\Users\Stefan\AppData\Roaming\Mozilla C:\Users\Stefan\AppData\Roaming\Profiles DeleteKey: HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains CMD: type C:\Users\paulinka\AppData\Local\Google\Chrome\User Data\Profile 1\Secure Preferences EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. HKU\S-1-5-21-1822749172-3988503527-1915266406-1000_Classes\CLSID\{00000001-0E3A-4123-8B32-4B68A91E104A} => key removed successfully HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{813CC27D-1124-4CFE-A7A9-1BF8D640A797} => key removed successfully HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{813CC27D-1124-4CFE-A7A9-1BF8D640A797} => key removed successfully C:\Windows\System32\Tasks\DigitalSite => moved successfully HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DigitalSite => key removed successfully C:\Windows\Tasks\DigitalSite.job => moved successfully C:\Users\paulinka\AppData\Roaming\DIGITA~1 => moved successfully C:\Users\paulinka\AppData\Local\Google\Chrome\User Data\Program uruchamiajacy aplikacje Chrome.lnk => not found. C:\Users\paulinka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Program uruchamiajacy aplikacje Chrome.lnk => not found. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\fst_gb_13 => value removed successfully "c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll" => Value data removed successfully. " c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll" => Value data removed successfully. "c:\progra~3\bitguard" => not found. HKLM\SOFTWARE\Policies\Google => key removed successfully HKU\S-1-5-21-1822749172-3988503527-1915266406-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{50fafaf0-70a9-419d-a109-fa4b4ffd4e37} => value removed successfully HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key removed successfully HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key removed successfully HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. HKU\S-1-5-21-1822749172-3988503527-1915266406-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4b71-B0A3-3D82E62A6909} => key removed successfully HKCR\CLSID\{483830EE-A4CD-4b71-B0A3-3D82E62A6909} => key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A8FB70FA-0FDF-4601-9DC4-BFA1B357204F} => key removed successfully HKCR\Wow6432Node\CLSID\{A8FB70FA-0FDF-4601-9DC4-BFA1B357204F} => key not found. HKU\S-1-5-21-1822749172-3988503527-1915266406-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value removed successfully HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => key not found. HKU\S-1-5-21-1822749172-3988503527-1915266406-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{50FAFAF0-70A9-419D-A109-FA4B4FFD4E37} => value removed successfully HKCR\CLSID\{50FAFAF0-70A9-419D-A109-FA4B4FFD4E37} => key not found. HKU\S-1-5-21-1822749172-3988503527-1915266406-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B} => key removed successfully HKCR\CLSID\{31090377-0740-419E-BEFC-A56E50500D5B} => key not found. HKU\S-1-5-21-1822749172-3988503527-1915266406-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4b71-B0A3-3D82E62A6909} => key not found. HKCR\CLSID\{483830EE-A4CD-4b71-B0A3-3D82E62A6909} => key not found. HKU\S-1-5-21-1822749172-3988503527-1915266406-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8} => key removed successfully HKCR\CLSID\{77AA745B-F4F8-45DA-9B14-61D2D95054C8} => key not found. HKU\S-1-5-21-1822749172-3988503527-1915266406-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => key removed successfully HKCR\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => key not found. HKU\S-1-5-21-1822749172-3988503527-1915266406-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{213BD86A-D8DE-47C7-AA9A-CF771C6850EF} => key removed successfully HKCR\CLSID\{213BD86A-D8DE-47C7-AA9A-CF771C6850EF} => key not found. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B} => key removed successfully HKCR\CLSID\{31090377-0740-419E-BEFC-A56E50500D5B} => key not found. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8} => key removed successfully HKCR\CLSID\{77AA745B-F4F8-45DA-9B14-61D2D95054C8} => key not found. C:\Users\paulinka\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\iagcajndpnfncplednpbnkahadegklfa => moved successfully HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome.R7UGBHHLDKADMYR2SRVGFTQTX4\shell\open\command\\Default => value restored successfully HKLM\System\CurrentControlSet\Services\SupportSoft RemoteAssist => key removed successfully SupportSoft RemoteAssist => service removed successfully HKLM\System\CurrentControlSet\Services\RSUSBSTOR => key removed successfully RSUSBSTOR => service removed successfully HKLM\System\CurrentControlSet\Services\RSUSBVSTOR => key removed successfully RSUSBVSTOR => service removed successfully HKCU\Software\Mozilla => key removed successfully HKCU\Software\MozillaPlugins => key removed successfully HKLM\SOFTWARE\Mozilla => key removed successfully HKLM\SOFTWARE\MozillaPlugins => key removed successfully HKLM\SOFTWARE\Wow6432Node\Mozilla => key removed successfully HKLM\SOFTWARE\Wow6432Node\mozilla.org => key not found. HKLM\SOFTWARE\Wow6432Node\MozillaPlugins => key removed successfully "C:\Users\Stefan\AppData\Local\Mozilla" => not found. "C:\Users\Stefan\AppData\Roaming\Mozilla" => not found. "C:\Users\Stefan\AppData\Roaming\Profiles" => not found. HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains => key removed successfully HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains => key removed successfully ========= type C:\Users\paulinka\AppData\Local\Google\Chrome\User Data\Profile 1\Secure Preferences ========= The system cannot find the file specified. Error occurred while processing: C:\Users\paulinka\AppData\Local\Google\Chrome\User. The system cannot find the path specified. ========= End of CMD: ========= =========== EmptyTemp: ========== BITS transfer queue => 8388608 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 238576715 B Java, Flash, Steam htmlcache => 35168 B Windows/system/drivers => 41341154252 B Edge => 0 B Chrome => 45098932 B Firefox => 0 B Opera => 0 B Temp, IE cache, history, cookies, recent: Users => 0 B Default => 0 B Public => 0 B ProgramData => 0 B systemprofile => 165740 B systemprofile32 => 575373 B LocalService => 1694 B NetworkService => 5300512 B paulinka => 14516486089 B RecycleBin => 0 B EmptyTemp: => 52.3 GB temporary data Removed. ================================ The system needed a reboot. ==== End of Fixlog 15:02:40 ====