Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 28-08-2013 Ran by Paweł at 2013-08-30 17:25:38 Run:1 Running from C:\Users\Paweł\Desktop\MSSE Problem Boot Mode: Normal ============================================== Content of fixlist: ***************** HKCU\...\Run: [ZEJEFKG] - C:\Users\Paweł\AppData\Roaming\wimservd.dll [233472 2013-06-27] () HKCU\...\Run: [EA Core] - "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent [x] HKCU\...\Run: [Media Finder] - "C:\Program Files\Media Finder\Media Finder.exe" /opentotray [x] HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=121845&babsrc=HP_ss_din2g&mntrId=AED000265E9E5E0C URLSearchHook: (No Name) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - No File URLSearchHook: (No Name) - {687578b9-7132-4a7a-80e4-30ee31099e03} - No File SearchScopes: HKLM - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029 SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029 SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://search.babylon.com/?q={searchTerms}&affID=121845&babsrc=SP_ss_din2g&mntrId=AED000265E9E5E0C SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://search.babylon.com/?q={searchTerms}&affID=121845&babsrc=SP_ss_din2g&mntrId=AED000265E9E5E0C SearchScopes: HKCU - {433D4039-5211-48F5-8EDB-6E6A77922095} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=crm&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=3B72513C-04A3-4967-9652-41E423894A82&apn_sauid=20957DBA-B94A-4864-B628-91AAAF1D271F SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029 Toolbar: HKCU -No Name - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - No File Toolbar: HKCU -No Name - {687578B9-7132-4A7A-80E4-30EE31099E03} - No File Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll No File Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll No File FF Plugin: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll No File FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\avg_igeared.xml Task: {0A86F80F-9860-4131-8AA4-44843E175527} - System32\Tasks\{534E0E38-59D2-472C-857F-254B12356878} => D:\start.exe No File Task: {2A37BF26-90F5-4BD3-81E3-03D81A6FBCDA} - System32\Tasks\{95F0A776-CCC2-4460-938D-A3F15449B632} => D:\start.exe No File Task: {8D32E4A3-7995-48FC-B20D-1412C0B09376} - System32\Tasks\{0C59AD6D-938F-41D0-84E5-FF1D126EB0F0} => D:\start.exe No File Task: {DE229819-3ADC-40E2-BEE5-5FB27638121B} - System32\Tasks\{F8D0B5B0-B52E-4343-BCE1-D51DA0857084} => D:\start.exe No File Task: {DF911AA6-89AA-4F50-AA3A-FCAAEA8DDA66} - System32\Tasks\{8B370094-4E5F-4C78-AA3C-5BE000D916ED} => D:\start.exe No File Unlock: HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg Unlock: HKLM\SYSTEM\CurrentControlSet\Services\sptd S2 NOD32FiXTemDono; C:\Windows\nod32fixtemdono.reg [568 2008-03-03] () S3 fsssvc; "C:\Program Files\Windows Live\Family Safety\fsssvc.exe" [x] S4 sptd; \SystemRoot\System32\Drivers\sptd.sys [x] S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x] S3 ZTEusbnet; system32\DRIVERS\ZTEusbnet.sys [x] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x] C:\Users\Paweł\AppData\Roaming\wimservd.dll C:\Users\Paweł\AppData\Roaming\AVG10 C:\Users\Paweł\AppData\Roaming\Media Finder C:\Users\Paweł\AppData\Roaming\PerformerSoft C:\ProgramData\BrowserDefender C:\Program Files\File Scout C:\Windows\nod32fixtemdono.reg Reg: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder" /f Reg: reg delete "HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder" /f ***************** HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\ZEJEFKG => Value deleted successfully. HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\EA Core => Value deleted successfully. HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Media Finder => Value deleted successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value deleted successfully. HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} => Value deleted successfully. HKCR\CLSID\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} => Key not found. HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{687578b9-7132-4a7a-80e4-30ee31099e03} => Value deleted successfully. HKCR\CLSID\{687578b9-7132-4a7a-80e4-30ee31099e03} => Key not found. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{433D4039-5211-48F5-8EDB-6E6A77922095} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{433D4039-5211-48F5-8EDB-6E6A77922095} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key not found. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} => Value deleted successfully. HKCR\CLSID\{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} => Key not found. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{687578B9-7132-4A7A-80E4-30EE31099E03} => Value deleted successfully. HKCR\CLSID\{687578B9-7132-4A7A-80E4-30EE31099E03} => Key not found. HKCR\PROTOCOLS\Handler\livecall => Key deleted successfully. HKCR\CLSID\{828030A1-22C1-4009-854F-8E305202313F} => Key deleted successfully. HKCR\PROTOCOLS\Handler\msnim => Key deleted successfully. HKCR\CLSID\{828030A1-22C1-4009-854F-8E305202313F} => Key not found. HKCR\PROTOCOLS\Handler\wlmailhtml => Key deleted successfully. HKCR\CLSID\{03C514A3-1EFB-4856-9F99-10D7BE1653C0} => Key deleted successfully. HKCR\PROTOCOLS\Handler\wlpg => Key deleted successfully. HKCR\CLSID\{E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} => Key deleted successfully. HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912 => Key deleted successfully. C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll not found. C:\Program Files\mozilla firefox\searchplugins\avg_igeared.xml => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0A86F80F-9860-4131-8AA4-44843E175527} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0A86F80F-9860-4131-8AA4-44843E175527} => Key deleted successfully. C:\Windows\System32\Tasks\{534E0E38-59D2-472C-857F-254B12356878} => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{534E0E38-59D2-472C-857F-254B12356878} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2A37BF26-90F5-4BD3-81E3-03D81A6FBCDA} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2A37BF26-90F5-4BD3-81E3-03D81A6FBCDA} => Key deleted successfully. C:\Windows\System32\Tasks\{95F0A776-CCC2-4460-938D-A3F15449B632} => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{95F0A776-CCC2-4460-938D-A3F15449B632} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8D32E4A3-7995-48FC-B20D-1412C0B09376} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8D32E4A3-7995-48FC-B20D-1412C0B09376} => Key deleted successfully. C:\Windows\System32\Tasks\{0C59AD6D-938F-41D0-84E5-FF1D126EB0F0} => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{0C59AD6D-938F-41D0-84E5-FF1D126EB0F0} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DE229819-3ADC-40E2-BEE5-5FB27638121B} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DE229819-3ADC-40E2-BEE5-5FB27638121B} => Key deleted successfully. C:\Windows\System32\Tasks\{F8D0B5B0-B52E-4343-BCE1-D51DA0857084} => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{F8D0B5B0-B52E-4343-BCE1-D51DA0857084} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DF911AA6-89AA-4F50-AA3A-FCAAEA8DDA66} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DF911AA6-89AA-4F50-AA3A-FCAAEA8DDA66} => Key deleted successfully. C:\Windows\System32\Tasks\{8B370094-4E5F-4C78-AA3C-5BE000D916ED} => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{8B370094-4E5F-4C78-AA3C-5BE000D916ED} => Key deleted successfully. "HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg" => Key unlocked successfully. "HKLM\SYSTEM\CurrentControlSet\Services\sptd" => Key unlocked successfully. NOD32FiXTemDono => Service deleted successfully. fsssvc => Service deleted successfully. sptd => Service deleted successfully. ZTEusbmdm6k => Service deleted successfully. ZTEusbnet => Service deleted successfully. ZTEusbnmea => Service deleted successfully. ZTEusbser6k => Service deleted successfully. C:\Users\Paweł\AppData\Roaming\wimservd.dll => Moved successfully. C:\Users\Paweł\AppData\Roaming\AVG10 => Moved successfully. C:\Users\Paweł\AppData\Roaming\Media Finder => Moved successfully. C:\Users\Paweł\AppData\Roaming\PerformerSoft => Moved successfully. C:\ProgramData\BrowserDefender => Moved successfully. C:\Program Files\File Scout => Moved successfully. C:\Windows\nod32fixtemdono.reg => Moved successfully. ========= reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder" /f ========= Bť¤D: System nie znalazˆ w rejestrze okre˜lonego klucza albo warto˜ci. ========= End of Reg: ========= ========= reg delete "HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ==== End of Fixlog ====