Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 10-02-2014 Ran by Ja at 2014-02-10 20:22:07 Run:1 Running from C:\Documents and Settings\Ja\Moje dokumenty\Downloads Boot Mode: Normal ============================================== Content of fixlist: ***************** (APN LLC.) C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\VNT\vntldr.exe (Cherished Technololgy LIMITED) C:\Documents and Settings\All Users\Dane aplikacji\IePluginService\PluginService.exe (Cherished Technololgy LIMITED) C:\Documents and Settings\All Users\Dane aplikacji\WPM\wprotectmanager.exe () C:\Program Files\mutualpublic\Monitor.exe () C:\Program Files\LemurLeap\updateLemurLeap.exe () C:\Program Files\LemurLeap\bin\utilLemurLeap.exe R2 IePluginService; C:\Documents and Settings\All Users\Dane aplikacji\IePluginService\PluginService.exe [508016 2014-01-14] (Cherished Technololgy LIMITED) R2 Mutual Monitor; C:\Program Files\mutualpublic\Monitor.exe [544312 2013-11-09] () R2 Update LemurLeap; C:\Program Files\LemurLeap\updateLemurLeap.exe [80160 2014-02-08] () R2 Util LemurLeap; C:\Program Files\LemurLeap\bin\utilLemurLeap.exe [80160 2014-02-08] () R2 Wpm; C:\Documents and Settings\All Users\Dane aplikacji\WPM\wprotectmanager.exe [493568 2014-02-10] (Cherished Technololgy LIMITED) S3 EagleXNt; \??\C:\WINDOWS\system32\drivers\EagleXNt.sys [X] S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] S3 gfiark; system32\drivers\gfiark.sys [X] S3 MSICDSetup; \??\J:\CDriver.sys [X] S3 NTIOLib_1_0_C; \??\J:\NTIOLib.sys [X] S1 sbaphd; system32\drivers\sbaphd.sys [X] S2 sbapifs; system32\drivers\sbapifs.sys [X] S3 XDva397; \??\C:\WINDOWS\system32\XDva397.sys [X] HKLM\...\Run: [] - [X] HKLM\...\Run: [VNT] - C:\Program Files\VNT\vntldr.exe [202192 2013-12-31] (APN LLC.) Winlogon\Notify\TPSvc: TPSvc.dll [X] HKU\S-1-5-21-2052111302-823518204-839522115-1004\...\Run: [EA Core] - "D:\Nowy folder (3)\EADM\Core.exe" -silent HKU\S-1-5-21-2052111302-823518204-839522115-1004\...\Run: [ChomikBox] - E:\ChomikBox.exe HKU\S-1-5-21-2052111302-823518204-839522115-1004\...\Run: [ChicaPasswordManager] - "C:\Program Files\ChicaLogic\Chica Password Manager\stpass.exe" /autorunned HKU\S-1-5-21-2052111302-823518204-839522115-1004\...\Run: [NextLive] - C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\Ja\Dane aplikacji\newnext.me\nengine.dll",EntryPoint -m l HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.awesomehp.com/?type=hp&ts=1392048302&from=amt&uid=WDCXWD1600JB-00REA0_WD-WMANM630045800458 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.awesomehp.com/?type=hp&ts=1392048302&from=amt&uid=WDCXWD1600JB-00REA0_WD-WMANM630045800458 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.awesomehp.com/web/?type=ds&ts=1392048302&from=amt&uid=WDCXWD1600JB-00REA0_WD-WMANM630045800458&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.awesomehp.com/web/?type=ds&ts=1392048302&from=amt&uid=WDCXWD1600JB-00REA0_WD-WMANM630045800458&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.awesomehp.com/?type=hp&ts=1392048302&from=amt&uid=WDCXWD1600JB-00REA0_WD-WMANM630045800458 URLSearchHook: ATTENTION ==> Default URLSearchHook is missing. StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.awesomehp.com/?type=sc&ts=1392048302&from=amt&uid=WDCXWD1600JB-00REA0_WD-WMANM630045800458 SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e} SearchScopes: HKCU - {9CCE7133-C8E6-4A49-8B7A-296B6158C277} URL = http://www.idg.pl?q={searchTerms} BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files\SupTab\SupTab.dll (Thinknice Co. Limited) BHO: LemurLeap - {415419c3-dad0-4df1-ac37-22c72ad81878} - C:\Program Files\LemurLeap\LemurLeapBHO.dll (LemurLeap) BHO: Video Player - {8cb24fda-af11-4dda-8f00-e78b7f392c74} - C:\Program Files\VideoPlayerV3\VideoPlayerV3beta924\ie\VideoPlayerV3beta924.dll () BHO: Webexp Enhanced - {a04e179c-d558-49f2-bf36-1cb85598070b} - C:\Program Files\WebexpEnhancedV1\WebexpEnhancedV1alpha93\ie\WebexpEnhancedV1alpha93.dll () CHR HKLM\...\Chrome\Extension: [aaaajabnoiehionljhjpclogplgillib] - C:\Documents and Settings\All Users\Dane aplikacji\AskPartnerNetwork\Toolbar\CME-V7\CRX\ToolbarCR.crx [2013-03-19] CHR HKLM\...\Chrome\Extension: [dedmngkbaffkenlfdcbganndoghblmap] - C:\Program Files\BetterSurf\ch\Chrome.crx [2013-11-11] CHR HKLM\...\Chrome\Extension: [ggnanoadjmieidbaeiihpoekhdompgbm] - C:\Program Files\VideoPlayerV3\VideoPlayerV3beta924\ch\VideoPlayerV3beta924.crx [2014-01-07] CHR HKLM\...\Chrome\Extension: [jlnfdbbladgcmhhamgkioifhbobjaoof] - C:\Program Files\LemurLeap\jlnfdbbladgcmhhamgkioifhbobjaoof.crx [2014-02-10] CHR HKLM\...\Chrome\Extension: [jnbpddpnmhfnidgidlblpekpffdkedpp] - C:\Program Files\WebexpEnhancedV1\WebexpEnhancedV1alpha93\ch\WebexpEnhancedV1alpha93.crx [2013-12-19] CHR HKLM\...\Chrome\Extension: [mmifolfpllfdhilecpdpmemhelmanajl] - C:\Program Files\BetterSurf\BetterSurfPlus\ch\BetterSurfPlus.crx [2013-12-10] CHR HKLM\...\Chrome\Extension: [pkndmigholgfjlniaohblojbhgjbkakn] - C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\newtabv2.crx [2014-02-10] CHR StartMenuInternet: Google Chrome - C:\Program Files\Google\Chrome\Application\chrome.exe http://www.awesomehp.com/?type=sc&ts=1392048302&from=amt&uid=WDCXWD1600JB-00REA0_WD-WMANM630045800458 C:\Documents and Settings\All Users\Dane aplikacji\86a19f938d11bd22 C:\Documents and Settings\All Users\Dane aplikacji\TEMP C:\Documents and Settings\Ja\Dane aplikacji\0ad C:\Documents and Settings\Ja\Dane aplikacji\Mozilla C:\Documents and Settings\Ja\Dane aplikacji\newnext.me C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\cache C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\genienext C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\Mobogenie C:\Program Files\BetterSurf C:\Program Files\Enigma Software Group C:\Program Files\Mozilla Firefox C:\WINDOWS\455F074C814E4520B69B5584BD90400C.TMP Reg: reg delete HKCU\Software\Mozilla /f Reg: reg delete HKCU\Software\MozillaPlugins /f Reg: reg delete HKLM\SOFTWARE\Mozilla /f Reg: reg delete HKLM\SOFTWARE\mozilla.org /f Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ***************** [1308] C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\VNT\vntldr.exe => Process closed successfully. [1744] C:\Documents and Settings\All Users\Dane aplikacji\IePluginService\PluginService.exe => Process closed successfully. [1816] C:\Documents and Settings\All Users\Dane aplikacji\WPM\wprotectmanager.exe => Process closed successfully. [2224] C:\Program Files\mutualpublic\Monitor.exe => Process closed successfully. [2824] C:\Program Files\LemurLeap\updateLemurLeap.exe => Process closed successfully. [2980] C:\Program Files\LemurLeap\bin\utilLemurLeap.exe => Process closed successfully. IePluginService => Service deleted successfully. Mutual Monitor => Service deleted successfully. Update LemurLeap => Service deleted successfully. Util LemurLeap => Service deleted successfully. Wpm => Service deleted successfully. EagleXNt => Service deleted successfully. esgiguard => Service deleted successfully. gfiark => Service deleted successfully. MSICDSetup => Service deleted successfully. NTIOLib_1_0_C => Service deleted successfully. sbaphd => Service deleted successfully. sbapifs => Service deleted successfully. XDva397 => Service deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\VNT => Value deleted successfully. HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\TPSvc => Key deleted successfully. HKU\S-1-5-21-2052111302-823518204-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Run\\EA Core => Value deleted successfully. HKU\S-1-5-21-2052111302-823518204-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Run\\ChomikBox => Value deleted successfully. HKU\S-1-5-21-2052111302-823518204-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Run\\ChicaPasswordManager => Value deleted successfully. HKU\S-1-5-21-2052111302-823518204-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Run\\NextLive => Value deleted successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. Default URLSearchHook was restored successfully . HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\ToolbarSearchProviderProgress => Value deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9CCE7133-C8E6-4A49-8B7A-296B6158C277} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{9CCE7133-C8E6-4A49-8B7A-296B6158C277} => Key not found. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} => Key deleted successfully. HKCR\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{415419c3-dad0-4df1-ac37-22c72ad81878} => Key deleted successfully. HKCR\CLSID\{415419c3-dad0-4df1-ac37-22c72ad81878} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8cb24fda-af11-4dda-8f00-e78b7f392c74} => Key deleted successfully. HKCR\CLSID\{8cb24fda-af11-4dda-8f00-e78b7f392c74} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a04e179c-d558-49f2-bf36-1cb85598070b} => Key deleted successfully. HKCR\CLSID\{a04e179c-d558-49f2-bf36-1cb85598070b} => Key deleted successfully. HKLM\SOFTWARE\Google\Chrome\Extensions\aaaajabnoiehionljhjpclogplgillib => Key deleted successfully. "C:\Documents and Settings\All Users\Dane aplikacji\AskPartnerNetwork\Toolbar\CME-V7\CRX\ToolbarCR.crx" => File/Directory not found. HKLM\SOFTWARE\Google\Chrome\Extensions\dedmngkbaffkenlfdcbganndoghblmap => Key deleted successfully. C:\Program Files\BetterSurf\ch\Chrome.crx => Moved successfully. HKLM\SOFTWARE\Google\Chrome\Extensions\ggnanoadjmieidbaeiihpoekhdompgbm => Key deleted successfully. C:\Program Files\VideoPlayerV3\VideoPlayerV3beta924\ch\VideoPlayerV3beta924.crx => Moved successfully. HKLM\SOFTWARE\Google\Chrome\Extensions\jlnfdbbladgcmhhamgkioifhbobjaoof => Key deleted successfully. "C:\Program Files\LemurLeap\jlnfdbbladgcmhhamgkioifhbobjaoof.crx" => File/Directory not found. HKLM\SOFTWARE\Google\Chrome\Extensions\jnbpddpnmhfnidgidlblpekpffdkedpp => Key deleted successfully. C:\Program Files\WebexpEnhancedV1\WebexpEnhancedV1alpha93\ch\WebexpEnhancedV1alpha93.crx => Moved successfully. HKLM\SOFTWARE\Google\Chrome\Extensions\mmifolfpllfdhilecpdpmemhelmanajl => Key deleted successfully. C:\Program Files\BetterSurf\BetterSurfPlus\ch\BetterSurfPlus.crx => Moved successfully. HKLM\SOFTWARE\Google\Chrome\Extensions\pkndmigholgfjlniaohblojbhgjbkakn => Key deleted successfully. C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\newtabv2.crx => Moved successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command\\Default => Value was restored successfully. C:\Documents and Settings\All Users\Dane aplikacji\86a19f938d11bd22 => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\TEMP => Moved successfully. C:\Documents and Settings\Ja\Dane aplikacji\0ad => Moved successfully. C:\Documents and Settings\Ja\Dane aplikacji\Mozilla => Moved successfully. C:\Documents and Settings\Ja\Dane aplikacji\newnext.me => Moved successfully. C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\cache => Moved successfully. C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\genienext => Moved successfully. C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\Mobogenie => Moved successfully. C:\Program Files\BetterSurf => Moved successfully. C:\Program Files\Enigma Software Group => Moved successfully. C:\Program Files\Mozilla Firefox => Moved successfully. C:\WINDOWS\455F074C814E4520B69B5584BD90400C.TMP => Moved successfully. ========= reg delete HKCU\Software\Mozilla /f ========= Błąd: system nie może odnaleźć określonego klucza rejestru lub wartości. ========= End of Reg: ========= ========= reg delete HKCU\Software\MozillaPlugins /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Mozilla /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\mozilla.org /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\MozillaPlugins /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= The system needs a manual reboot. ==== End of Fixlog ====