Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 12-02-2014 01 Ran by administrator at 2014-02-18 10:27:43 Run:1 Running from C:\Documents and Settings\Administrator.SBSMENIS.000\Pulpit\FixIt Boot Mode: Normal ============================================== Content of fixlist: ***************** ShellExecuteHooks: Microsoft AntiMalware ShellExecuteHook - {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\PROGRA~1\WIFD1F~1\MpShHook.dll No File [ ] NETSVC: uanaoqwjn -> No Registry Path. NETSVC: bktqki -> No Registry Path. NETSVC: dtcjwjm -> No Registry Path. NETSVC: womwyn -> No Registry Path. Unlock: HKLM\SYSTEM\ControlSet002\Services\bktqki Unlock: HKLM\SYSTEM\ControlSet002\Services\dtcjwjm Unlock: HKLM\SYSTEM\ControlSet002\Services\uanaoqwjn Unlock: HKLM\SYSTEM\ControlSet002\Services\womwyn Unlock: HKLM\SYSTEM\ControlSet003\Services\bktqki Unlock: HKLM\SYSTEM\ControlSet003\Services\dtcjwjm Unlock: HKLM\SYSTEM\ControlSet003\Services\uanaoqwjn Reg: reg delete HKLM\SYSTEM\ControlSet002\Services\bktqki /f Reg: reg delete HKLM\SYSTEM\ControlSet002\Services\dtcjwjm /f Reg: reg delete HKLM\SYSTEM\ControlSet002\Services\uanaoqwjn /f Reg: reg delete HKLM\SYSTEM\ControlSet002\Services\womwyn /f Reg: reg delete HKLM\SYSTEM\ControlSet003\Services\bktqki /f Reg: reg delete HKLM\SYSTEM\ControlSet003\Services\dtcjwjm /f Reg: reg delete HKLM\SYSTEM\ControlSet003\Services\uanaoqwjn /f C:\Documents and Settings\student007d\Dane aplikacji\BabylonToolbar C:\Documents and Settings\student007d\Dane aplikacji\OpenCandy C:\Documents and Settings\student123d\Dane aplikacji\BabylonToolbar C:\WINDOWS\A6448DEA02A34BDEA2C39C431ABCF2D2.TMP ***************** HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks\\{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} => Value deleted successfully. HKCR\CLSID\{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\\netsvcs uanaoqwjn => Value deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\\netsvcs bktqki => Value deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\\netsvcs dtcjwjm => Value deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\\netsvcs womwyn => Value deleted successfully. "HKLM\SYSTEM\ControlSet002\Services\bktqki" => Key unlocked successfully. "HKLM\SYSTEM\ControlSet002\Services\dtcjwjm" => Key unlocked successfully. "HKLM\SYSTEM\ControlSet002\Services\uanaoqwjn" => Key unlocked successfully. "HKLM\SYSTEM\ControlSet002\Services\womwyn" => Key unlocked successfully. "HKLM\SYSTEM\ControlSet003\Services\bktqki" => Key unlocked successfully. "HKLM\SYSTEM\ControlSet003\Services\dtcjwjm" => Key unlocked successfully. "HKLM\SYSTEM\ControlSet003\Services\uanaoqwjn" => Key unlocked successfully. ========= reg delete HKLM\SYSTEM\ControlSet002\Services\bktqki /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete HKLM\SYSTEM\ControlSet002\Services\dtcjwjm /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete HKLM\SYSTEM\ControlSet002\Services\uanaoqwjn /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete HKLM\SYSTEM\ControlSet002\Services\womwyn /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete HKLM\SYSTEM\ControlSet003\Services\bktqki /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete HKLM\SYSTEM\ControlSet003\Services\dtcjwjm /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete HKLM\SYSTEM\ControlSet003\Services\uanaoqwjn /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= C:\Documents and Settings\student007d\Dane aplikacji\BabylonToolbar => Moved successfully. C:\Documents and Settings\student007d\Dane aplikacji\OpenCandy => Moved successfully. C:\Documents and Settings\student123d\Dane aplikacji\BabylonToolbar => Moved successfully. C:\WINDOWS\A6448DEA02A34BDEA2C39C431ABCF2D2.TMP => Moved successfully. ==== End of Fixlog ====