Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-02-2014 Ran by Agnieszka at 2014-02-17 22:07:58 Run:1 Running from C:\Users\Agnieszka\Desktop\autograph Boot Mode: Normal ============================================== Content of fixlist: ***************** Task: {D63FE7D8-F7D5-43C9-97B2-3D333FB50E18} - System32\Tasks\Digital Sites => C:\Users\AGNIES~1\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION Task: {FA66FA68-63DA-44F5-81EC-2363521FE2A6} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2012-04-09] () <==== ATTENTION Task: C:\Windows\Tasks\Digital Sites.job => C:\Users\AGNIES~1\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION HKLM-x32\...\Run: [] - [X] HKLM-x32\...\Run: [AnyProtect Tray] - C:\Program Files (x86)\AnyProtectEx\AnyProtectTray.exe /scanner HKLM-x32\...\Run: [AnyProtect] - C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe URLSearchHook: HKLM-x32 - (No Name) - {5c5b9468-d672-4eb7-b52f-b5afabf28c5b} - No File URLSearchHook: HKCU - (No Name) - {5c5b9468-d672-4eb7-b52f-b5afabf28c5b} - No File SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031817 SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=BC4B001E65473CE9&affID=119357&tsp=4985 SearchScopes: HKCU - {11F11C32-2045-4B0E-A039-C570056E0584} URL = SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031817 SearchScopes: HKCU - {F1D88A11-D5ED-4B4C-A457-2FF08B4A3AB5} URL = http://websearch.ask.com/custom/java/redirect?client=ie&tb=ORJ&o=100000026&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000 BHO-x32: No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} - No File BHO-x32: No Name - {5c5b9468-d672-4eb7-b52f-b5afabf28c5b} - No File Toolbar: HKLM-x32 - No Name - {5c5b9468-d672-4eb7-b52f-b5afabf28c5b} - No File Toolbar: HKLM-x32 - No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} - No File Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File CHR HKCU\...\Chrome\Extension: [efbkdhmfnmnmfimllbjamfodcoanhmdd] - C:\Users\AGNIES~1\AppData\Local\WebToSave.crx [2013-09-06] CHR HKLM-x32\...\Chrome\Extension: [ieakfmpjhljbpbfpldjkddkjmmgjmgon] - C:\Program Files (x86)\WebConnect\ieakfmpjhljbpbfpldjkddkjmmgjmgon.crx [2013-09-06] S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X] S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X] S3 massfilter; system32\drivers\massfilter.sys [X] S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X] S3 ZTEusbnet; system32\DRIVERS\ZTEusbnet.sys [X] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X] U3 aswMBR; \??\C:\Users\AGNIES~1\AppData\Local\Temp\aswMBR.sys [X] HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service" C:\Users\Agnieszka\AppData\Roaming\Babylon Reg: reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2" /f CMD: for /d %f in (C:\Users\Agnieszka\AppData\Local\{*}) do rd /s /q "%f" CMD: sc config "PLAY ONLINE. RunOuc" start= demand ***************** HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D63FE7D8-F7D5-43C9-97B2-3D333FB50E18} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D63FE7D8-F7D5-43C9-97B2-3D333FB50E18} => Key deleted successfully. C:\Windows\System32\Tasks\Digital Sites => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Digital Sites => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FA66FA68-63DA-44F5-81EC-2363521FE2A6} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FA66FA68-63DA-44F5-81EC-2363521FE2A6} => Key deleted successfully. C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar => Key deleted successfully. C:\Windows\Tasks\Digital Sites.job => Moved successfully. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\AnyProtect Tray => Value deleted successfully. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\AnyProtect => Value deleted successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks\\{5c5b9468-d672-4eb7-b52f-b5afabf28c5b} => Value deleted successfully. HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{5c5b9468-d672-4eb7-b52f-b5afabf28c5b} => Value deleted successfully. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key deleted successfully. HKCR\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{11F11C32-2045-4B0E-A039-C570056E0584} => Key deleted successfully. HKCR\CLSID\{11F11C32-2045-4B0E-A039-C570056E0584} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} => Key deleted successfully. HKCR\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key deleted successfully. HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key deleted successfully. HKCR\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{F1D88A11-D5ED-4B4C-A457-2FF08B4A3AB5} => Key deleted successfully. HKCR\CLSID\{F1D88A11-D5ED-4B4C-A457-2FF08B4A3AB5} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5c5b9468-d672-4eb7-b52f-b5afabf28c5b} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{5c5b9468-d672-4eb7-b52f-b5afabf28c5b} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{5c5b9468-d672-4eb7-b52f-b5afabf28c5b} => Value deleted successfully. HKCR\Wow6432Node\CLSID\{5c5b9468-d672-4eb7-b52f-b5afabf28c5b} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} => Value deleted successfully. HKCR\Wow6432Node\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D} => Key not found. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Value deleted successfully. HKCR\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Key not found. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} => Value deleted successfully. HKCR\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} => Key not found. HKCU\SOFTWARE\Google\Chrome\Extensions\efbkdhmfnmnmfimllbjamfodcoanhmdd => Key deleted successfully. C:\Users\AGNIES~1\AppData\Local\WebToSave.crx => Moved successfully. HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ieakfmpjhljbpbfpldjkddkjmmgjmgon => Key deleted successfully. "C:\Program Files (x86)\WebConnect\ieakfmpjhljbpbfpldjkddkjmmgjmgon.crx" => File/Directory not found. ewusbnet => Service deleted successfully. hwusbdev => Service deleted successfully. massfilter => Service deleted successfully. ZTEusbmdm6k => Service deleted successfully. ZTEusbnet => Service deleted successfully. ZTEusbnmea => Service deleted successfully. ZTEusbser6k => Service deleted successfully. aswMBR => Service deleted successfully. HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => Key deleted successfully. HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => Key deleted successfully. HKLM\System\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => Key deleted successfully. HKLM\System\CurrentControlSet\Control\SafeBoot\Network\MCODS => Key deleted successfully. HKLM\System\CurrentControlSet\Control\SafeBoot\Network\MpfService => Key deleted successfully. C:\Users\Agnieszka\AppData\Roaming\Babylon => Moved successfully. ========= reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= for /d %f in (C:\Users\Agnieszka\AppData\Local\{*}) do rd /s /q "%f" ========= ========= End of CMD: ========= ========= sc config "PLAY ONLINE. RunOuc" start= demand ========= [SC] ChangeServiceConfig SUKCES ========= End of CMD: ========= ==== End of Fixlog ====