Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-02-2014 Ran by Martensen at 2014-02-17 21:06:34 Run:1 Running from C:\Users\Martensen\Desktop\Nowy folder Boot Mode: Normal ============================================== Content of fixlist: ***************** HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?type=hp&ts=1388680335&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?type=hp&ts=1388680335&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www.searchgol.com/?babsrc=HP_ss&mntrId=BA6CB80305359EF0&affID=119357&tt=250913_nocpn&tsp=5018 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?type=ds&ts=1388696524&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?type=hp&ts=1388680335&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?type=hp&ts=1388680335&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?type=ds&ts=1388696524&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?type=ds&ts=1388696524&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?type=hp&ts=1388680335&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?type=hp&ts=1388680335&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?type=ds&ts=1388696524&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX&q={searchTerms} URLSearchHook: HKLM-x32 - uTorrentControl_v6 Toolbar - {96f454ea-9d38-474f-b504-56193e00c1a5} - C:\Program Files (x86)\uTorrentControl_v6\prxtbuTor.dll (Conduit Ltd.) URLSearchHook: HKCU - uTorrentControl_v6 Toolbar - {96f454ea-9d38-474f-b504-56193e00c1a5} - C:\Program Files (x86)\uTorrentControl_v6\prxtbuTor.dll (Conduit Ltd.) StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX&ts=1377245924 SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388696524&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX&q={searchTerms} SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388696524&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX&q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388696524&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX&q={searchTerms} SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388696524&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX&q={searchTerms} SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388696524&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX&q={searchTerms} SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.searchgol.com/?q={searchTerms}&babsrc=SP_ss_Btisdt7&mntrId=BA6CB80305359EF0&affID=119357&tt=250913_nocpn&tsp=5018 SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388696524&from=wpm0102&uid=HitachiXHTS547550A9E384_J1100016G0V46CG0V46CX&q={searchTerms} SearchScopes: HKCU - {40B65564-E911-4151-A76D-9C7C8605918D} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3289075&CUI=UN91687129173631828&UM=1 BHO-x32: uTorrentControl_v6 Toolbar - {96f454ea-9d38-474f-b504-56193e00c1a5} - C:\Program Files (x86)\uTorrentControl_v6\prxtbuTor.dll (Conduit Ltd.) Toolbar: HKLM-x32 - uTorrentControl_v6 Toolbar - {96f454ea-9d38-474f-b504-56193e00c1a5} - C:\Program Files (x86)\uTorrentControl_v6\prxtbuTor.dll (Conduit Ltd.) Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - \User Data\Default\Extensions\newtab.crx [2013-08-23] CHR HKLM-x32\...\Chrome\Extension: [jpmbfleldcgkldadpdinhjjopdfpjfjp] - C:\Users\Martensen\AppData\Local\Wajam\Chrome\wajam.crx [2013-05-02] HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe HKU\S-1-5-21-1480235242-2075340924-4091109271-1001\...\Run: [] - [X] HKU\S-1-5-21-1480235242-2075340924-4091109271-1001\...\Run: [NextLive] - C:\windows\SysWOW64\rundll32.exe "C:\Users\Martensen\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l HKU\S-1-5-21-1480235242-2075340924-4091109271-1001\...\Run: [BackgroundContainer] - "C:\windows\SysWOW64\Rundll32.exe" "C:\Users\Martensen\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <===== ATTENTION Task: {9CC15D8F-654C-4044-BECA-04E36375150E} - System32\Tasks\BackgroundContainer Startup Task => Rundll32.exe "C:\Users\Martensen\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun Task: {ADC70E37-BB11-485D-AAED-66CFABE1AE1D} - System32\Tasks\BitGuard => Sc.exe start BitGuard <==== ATTENTION Task: {D4A5F7E1-BB9B-4166-B35D-71ED542B12D0} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [424104 2013-08-11] (Taiwan Shui Mu Chih Ching Technology Limited.) R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [499856 2014-01-02] (Cherished Technololgy LIMITED) S3 GameConsoleService; "C:\Program Files (x86)\WildGames\Game Console - WildGames\GameConsoleService.exe" [X] S2 WsysSvc; C:\ProgramData\eSafe\eGdpSvc.exe [X] C:\Users\Martensen\AppData\Local\Conduit C:\Users\Martensen\AppData\Roaming\Babylon C:\Users\Martensen\AppData\Roaming\Desk 365 C:\Users\Martensen\AppData\Roaming\DVDVideoSoft C:\Users\Martensen\AppData\Roaming\eDownload C:\Users\Martensen\AppData\Roaming\eIntaller C:\Users\Martensen\AppData\Roaming\eUpdate C:\Users\Martensen\AppData\Roaming\Movdap C:\Users\Martensen\AppData\Roaming\newnext.me C:\Users\Martensen\Downloads\~WRL3818.tmp ***************** HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\bProtector Start Page => Value deleted successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks\\{96f454ea-9d38-474f-b504-56193e00c1a5} => Value deleted successfully. HKCR\Wow6432Node\CLSID\{96f454ea-9d38-474f-b504-56193e00c1a5} => Key deleted successfully. HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{96f454ea-9d38-474f-b504-56193e00c1a5} => Value deleted successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\bProtectorDefaultScope => Value deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key deleted successfully. HKCR\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{40B65564-E911-4151-A76D-9C7C8605918D} => Key deleted successfully. HKCR\CLSID\{40B65564-E911-4151-A76D-9C7C8605918D} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{96f454ea-9d38-474f-b504-56193e00c1a5} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{96f454ea-9d38-474f-b504-56193e00c1a5} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{96f454ea-9d38-474f-b504-56193e00c1a5} => Value deleted successfully. HKCR\Wow6432Node\CLSID\{96f454ea-9d38-474f-b504-56193e00c1a5} => Key not found. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Value deleted successfully. HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Key not found. HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo => Key deleted successfully. \User Data\Default\Extensions\newtab.crx => Moved successfully. HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp => Key deleted successfully. C:\Users\Martensen\AppData\Local\Wajam\Chrome\wajam.crx => Moved successfully. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\mobilegeni daemon => Value deleted successfully. HKU\S-1-5-21-1480235242-2075340924-4091109271-1001\Software\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully. HKU\S-1-5-21-1480235242-2075340924-4091109271-1001\Software\Microsoft\Windows\CurrentVersion\Run\\NextLive => Value deleted successfully. HKU\S-1-5-21-1480235242-2075340924-4091109271-1001\Software\Microsoft\Windows\CurrentVersion\Run\\BackgroundContainer => Value deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{9CC15D8F-654C-4044-BECA-04E36375150E} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9CC15D8F-654C-4044-BECA-04E36375150E} => Key deleted successfully. C:\Windows\System32\Tasks\BackgroundContainer Startup Task => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BackgroundContainer Startup Task => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{ADC70E37-BB11-485D-AAED-66CFABE1AE1D} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ADC70E37-BB11-485D-AAED-66CFABE1AE1D} => Key deleted successfully. C:\Windows\System32\Tasks\BitGuard => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BitGuard => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D4A5F7E1-BB9B-4166-B35D-71ED542B12D0} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D4A5F7E1-BB9B-4166-B35D-71ED542B12D0} => Key deleted successfully. C:\Windows\System32\Tasks\Desk 365 RunAsStdUser => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Desk 365 RunAsStdUser => Key deleted successfully. winzipersvc => Service deleted successfully. Wpm => Service deleted successfully. GameConsoleService => Service deleted successfully. WsysSvc => Service deleted successfully. C:\Users\Martensen\AppData\Local\Conduit => Moved successfully. C:\Users\Martensen\AppData\Roaming\Babylon => Moved successfully. C:\Users\Martensen\AppData\Roaming\Desk 365 => Moved successfully. C:\Users\Martensen\AppData\Roaming\DVDVideoSoft => Moved successfully. C:\Users\Martensen\AppData\Roaming\eDownload => Moved successfully. C:\Users\Martensen\AppData\Roaming\eIntaller => Moved successfully. C:\Users\Martensen\AppData\Roaming\eUpdate => Moved successfully. C:\Users\Martensen\AppData\Roaming\Movdap => Moved successfully. C:\Users\Martensen\AppData\Roaming\newnext.me => Moved successfully. C:\Users\Martensen\Downloads\~WRL3818.tmp => Moved successfully. The system needs a manual reboot. ==== End of Fixlog ====