Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-02-2014 Ran by Piotr at 2014-02-07 14:05:20 Run:1 Running from C:\Users\Piotr\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** AppInit_DLLs-x32: c:\progra~2\sshelp~1\sprote~1.dll => C:\Program Files (x86)\ss helper\sprotector.dll [1050112 2013-01-24] () Task: {A8BCCC11-37B5-4835-A202-853AE0DC0E64} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION Task: {AB07AC05-48A1-4F07-B2EE-0A4B00540C0E} - System32\Tasks\Dealply => C:\Users\Piotr\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE <==== ATTENTION Task: {EF0FCF88-A7CC-47F3-8468-5249DEDA57A0} - System32\Tasks\Omiga Plus RunAsStdUser => C:\Program Files (x86)\Omiga Plus\omigaplus.exe Task: C:\Windows\Tasks\Dealply.job => C:\Users\Piotr\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE <==== ATTENTION HKU\S-1-5-21-3817265874-1029240149-1278691232-1001\...\Run: [LiveSupport] - "C:\Program Files (x86)\LiveSupport\LiveSupport.exe" /noshow /log HKU\S-1-5-21-3817265874-1029240149-1278691232-1001\...\Winlogon: [Shell] explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION Winlogon\Notify\WB: C:\PROGRA~2\Stardock\OBJECT~1\WINDOW~1\fast64.dll [X] HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gazeta.pl/0,0.html?p=128 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.qvo6.com/?utm_source=b&utm_medium=amt&from=amt&uid=ST9640320AS_5WX0YAP1XXXX5WX0YAP1&ts=1375880183 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.qvo6.com/?utm_source=b&utm_medium=amt&from=amt&uid=ST9640320AS_5WX0YAP1XXXX5WX0YAP1&ts=1375880183 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qvo6.com/?utm_source=b&utm_medium=amt&from=amt&uid=ST9640320AS_5WX0YAP1XXXX5WX0YAP1&ts=1375880183 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.qvo6.com/?utm_source=b&utm_medium=amt&from=amt&uid=ST9640320AS_5WX0YAP1XXXX5WX0YAP1&ts=1375880183 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.qvo6.com/?utm_source=b&utm_medium=amt&from=amt&uid=ST9640320AS_5WX0YAP1XXXX5WX0YAP1&ts=1375880183 URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.qvo6.com/?utm_source=b&utm_medium=amt&from=amt&uid=ST9640320AS_5WX0YAP1XXXX5WX0YAP1&ts=1375880183 SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=ST9640320AS_5WX0YAP1XXXX5WX0YAP1&ts=1375880183 SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=ST9640320AS_5WX0YAP1XXXX5WX0YAP1&ts=1375880183 SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=ST9640320AS_5WX0YAP1XXXX5WX0YAP1&ts=1375880183 SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=ST9640320AS_5WX0YAP1XXXX5WX0YAP1&ts=1375880183 SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=ST9640320AS_5WX0YAP1XXXX5WX0YAP1&ts=1375880183 SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://startsear.ch/?aff=1&q={searchTerms} SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.delta-search.com/?q={searchTerms}&affID=121845&babsrc=SP_ss&mntrId=C8AE1C4BD610429E SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=amt&from=amt&uid=ST9640320AS_5WX0YAP1XXXX5WX0YAP1&ts=1375880183 SearchScopes: HKCU - {D1531AC7-2E44-4F2B-AF14-FC527B85FF48} URL = http://websearch.ask.com/redirect?client=ie&tb=FF&o=14594&src=crm&q={searchTerms}&locale=&apn_ptnrs=^FV&apn_dtid=^YYYYYY^YY^PL&apn_uid=eceeae19-d029-471e-ba30-4d1cd316d91a&apn_sauid=0390DFC2-042A-4F46-B240-5AB18B00AB05 BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File DPF: HKLM-x32 {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll No File FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\qvo6.xml CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION C:\Users\Piotr\AppData\Local\Google\Chrome C:\Users\Piotr\AppData\Local\Temp\*.exe C:\Users\Piotr\AppData\Roaming\Babylon C:\Users\Piotr\AppData\Roaming\Dealply C:\Users\Piotr\AppData\Roaming\Desk 365 C:\Users\Piotr\AppData\Roaming\eIntaller C:\Users\Piotr\AppData\Roaming\systweak C:\Windows\system32\roboot64.exe ***************** "c:\\progra~2\\sshelp~1\\sprote~1.dll" => Value Data removed successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A8BCCC11-37B5-4835-A202-853AE0DC0E64} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A8BCCC11-37B5-4835-A202-853AE0DC0E64} => Key deleted successfully. C:\Windows\System32\Tasks\Desk 365 RunAsStdUser => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Desk 365 RunAsStdUser => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AB07AC05-48A1-4F07-B2EE-0A4B00540C0E} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AB07AC05-48A1-4F07-B2EE-0A4B00540C0E} => Key deleted successfully. C:\Windows\System32\Tasks\Dealply => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Dealply => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{EF0FCF88-A7CC-47F3-8468-5249DEDA57A0} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EF0FCF88-A7CC-47F3-8468-5249DEDA57A0} => Key deleted successfully. C:\Windows\System32\Tasks\Omiga Plus RunAsStdUser => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Omiga Plus RunAsStdUser => Key deleted successfully. C:\Windows\Tasks\Dealply.job => Moved successfully. HKU\S-1-5-21-3817265874-1029240149-1278691232-1001\Software\Microsoft\Windows\CurrentVersion\Run\\LiveSupport => Value deleted successfully. HKU\S-1-5-21-3817265874-1029240149-1278691232-1001\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully. HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WB => Key deleted successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} => Value deleted successfully. HKCR\Wow6432Node\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC} => Key deleted successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully. HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key deleted successfully. HKCR\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D1531AC7-2E44-4F2B-AF14-FC527B85FF48} => Key deleted successfully. HKCR\CLSID\{D1531AC7-2E44-4F2B-AF14-FC527B85FF48} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} => Key deleted successfully. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} => Value deleted successfully. HKCR\Wow6432Node\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Code Store Database\Distribution Units\{68282C51-9459-467B-95BF-3C0E89627E55} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{68282C51-9459-467B-95BF-3C0E89627E55} => Key deleted successfully. HKCU\Software\MozillaPlugins\@lightspark.github.com/Lightspark;version=1 => Key deleted successfully. C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll not found. C:\Program Files (x86)\mozilla firefox\searchplugins\qvo6.xml => Moved successfully. HKLM\SOFTWARE\Policies\Google => Key deleted successfully. C:\Users\Piotr\AppData\Local\Google\Chrome => Moved successfully. C:\Users\Piotr\AppData\Local\Temp\*.exe => Moved successfully. C:\Users\Piotr\AppData\Roaming\Babylon => Moved successfully. C:\Users\Piotr\AppData\Roaming\Dealply => Moved successfully. C:\Users\Piotr\AppData\Roaming\Desk 365 => Moved successfully. C:\Users\Piotr\AppData\Roaming\eIntaller => Moved successfully. C:\Users\Piotr\AppData\Roaming\systweak => Moved successfully. C:\Windows\system32\roboot64.exe => Moved successfully. ==== End of Fixlog ====