Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-02-2014 Ran by anna at 2014-02-18 18:39:59 Run:1 Running from C:\Users\anna\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** (Cherished Technololgy LIMITED) C:\ProgramData\WPM\wprotectmanager.exe () C:\Program Files (x86)\FindRight\updateFindRight.exe () C:\Program Files (x86)\FindRight\bin\utilFindRight.exe R2 Update FindRight; C:\Program Files (x86)\FindRight\updateFindRight.exe [80672 2014-02-14] () R2 Util FindRight; C:\Program Files (x86)\FindRight\bin\utilFindRight.exe [80672 2014-02-17] () R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [493568 2014-02-17] (Cherished Technololgy LIMITED) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX&q={searchTerms} HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sweet-page.com/?type=hp&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sweet-page.com/?type=hp&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.sweet-page.com/?type=hp&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.sweet-page.com/?type=sc&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX&q={searchTerms} SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX&q={searchTerms} BHO-x32: FindRight - {2c774641-5504-46a8-b63f-6715ae3fe376} - C:\Program Files (x86)\FindRight\FindRightbho.dll (FindRight) FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://www.sweet-page.com/?type=sc&ts=1392662215&from=cor&uid=HitachiXHTS545050A7E380_130427TM85434925G87LX FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\sweet-page.xml FF HKLM-x32\...\Firefox\Extensions: [lightningnewtab@gmail.com] - C:\Users\anna\AppData\Roaming\Mozilla\Firefox\Profiles\jhfm5icr.default\extensions\lightningnewtab@gmail.com.xpi ***************** [1392] C:\ProgramData\WPM\wprotectmanager.exe => Process closed successfully. [2100] C:\Program Files (x86)\FindRight\updateFindRight.exe => Process closed successfully. [2180] C:\Program Files (x86)\FindRight\bin\utilFindRight.exe => Process closed successfully. Update FindRight => Service deleted successfully. Util FindRight => Service deleted successfully. Wpm => Service deleted successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2c774641-5504-46a8-b63f-6715ae3fe376} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{2c774641-5504-46a8-b63f-6715ae3fe376} => Key deleted successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\\Default => Value was restored successfully. C:\Program Files (x86)\mozilla firefox\browser\searchplugins\sweet-page.xml => Moved successfully. HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\lightningnewtab@gmail.com => Value deleted successfully. ==== End of Fixlog ====