Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 20-02-2014 Ran by Beata at 2014-02-21 10:55:18 Run:1 Running from C:\Users\Beata\Desktop\sprzÄ…tanie Boot Mode: Normal ============================================== Content of fixlist: ***************** HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.awesomehp.com/web/?type=ds&ts=1392811039&from=amt&uid=HitachiXHTS547575A9E384_120916J2340020DL8XYAX&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.awesomehp.com/?type=hp&ts=1392811039&from=amt&uid=HitachiXHTS547575A9E384_120916J2340020DL8XYAX HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.awesomehp.com/?type=hp&ts=1392811039&from=amt&uid=HitachiXHTS547575A9E384_120916J2340020DL8XYAX HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.awesomehp.com/web/?type=ds&ts=1392811039&from=amt&uid=HitachiXHTS547575A9E384_120916J2340020DL8XYAX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.awesomehp.com/web/?type=ds&ts=1392811039&from=amt&uid=HitachiXHTS547575A9E384_120916J2340020DL8XYAX&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = GroupPolicyUsers\S-1-5-21-2876023181-951684942-558716295-1001\User: Group Policy restriction detected <======= ATTENTION Task: {3B2D37E3-7B6C-4DD7-AD4E-C41AEBB170DF} - \DSite No Task File Task: {7040039F-E408-4930-8295-99F67FC3BB53} - \BitGuard No Task File Task: {E0D616B6-3A6D-4F3B-8BD0-CA3A7588DFEE} - \EPUpdater No Task File HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe AppInit_DLLs: c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll => File Not Found R4 kl1; system32\DRIVERS\kl1.sys [X] R4 KLIF; system32\DRIVERS\klif.sys [X] R4 klkbdflt; \SystemRoot\system32\DRIVERS\klkbdflt.sys [X] R4 klmouflt; \SystemRoot\system32\DRIVERS\klmouflt.sys [X] R4 klpd; \SystemRoot\system32\DRIVERS\klpd.sys [X] R4 klwfp; \SystemRoot\system32\DRIVERS\klwfp.sys [X] C:\Program Files\Enigma Software Group C:\Program Files (x86)\Mobogenie C:\Program Files (x86)\PCData C:\Program Files (x86)\SupTab C:\ProgramData\InstallMate C:\ProgramData\WPM C:\Users\Beata\.android C:\Users\Beata\daemonprocess.txt C:\Users\Beata\AppData\Local\cache C:\Users\Beata\AppData\Local\genienext C:\Users\Beata\AppData\Local\Mobogenie C:\Users\Beata\AppData\Roaming\awesomehp C:\Users\Beata\AppData\Roaming\SupTab C:\Users\Beata\AppData\Roaming\Zip Opener Packages C:\Users\Beata\Documents\Mobogenie C:\WINDOWS\ACF5FE1B377240688B872D2A6EFD0A05.TMP CMD: rd /s /q C:\AdwCleaner Reg: reg delete HKLM\SOFTWARE\Mozilla /f Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f Reg: reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {0633EE93-D776-472f-A0FF-E1416B8B2E3A} /f Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ***************** HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. C:\WINDOWS\system32\GroupPolicyUsers\S-1-5-21-2876023181-951684942-558716295-1001\User => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3B2D37E3-7B6C-4DD7-AD4E-C41AEBB170DF} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3B2D37E3-7B6C-4DD7-AD4E-C41AEBB170DF} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DSite => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7040039F-E408-4930-8295-99F67FC3BB53} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7040039F-E408-4930-8295-99F67FC3BB53} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BitGuard => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E0D616B6-3A6D-4F3B-8BD0-CA3A7588DFEE} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E0D616B6-3A6D-4F3B-8BD0-CA3A7588DFEE} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\EPUpdater => Key deleted successfully. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\mobilegeni daemon => Unable to delete value "c:\\progra~3\\bitguard\\271769~1.27\\{c16c1~1\\loader.dll" => Value Data removed successfully. kl1 => Service not found. KLIF => Service not found. klkbdflt => Service not found. klmouflt => Service not found. klpd => Service not found. klwfp => Service not found. C:\Program Files\Enigma Software Group => Moved successfully. C:\Program Files (x86)\Mobogenie => Moved successfully. C:\Program Files (x86)\PCData => Moved successfully. C:\Program Files (x86)\SupTab => Moved successfully. C:\ProgramData\InstallMate => Moved successfully. C:\ProgramData\WPM => Moved successfully. C:\Users\Beata\.android => Moved successfully. C:\Users\Beata\daemonprocess.txt => Moved successfully. C:\Users\Beata\AppData\Local\cache => Moved successfully. C:\Users\Beata\AppData\Local\genienext => Moved successfully. C:\Users\Beata\AppData\Local\Mobogenie => Moved successfully. C:\Users\Beata\AppData\Roaming\awesomehp => Moved successfully. C:\Users\Beata\AppData\Roaming\SupTab => Moved successfully. C:\Users\Beata\AppData\Roaming\Zip Opener Packages => Moved successfully. C:\Users\Beata\Documents\Mobogenie => Moved successfully. C:\WINDOWS\ACF5FE1B377240688B872D2A6EFD0A05.TMP => Moved successfully. ========= rd /s /q C:\AdwCleaner ========= Nie mo¾na odnale«† okre˜lonego pliku. ========= End of CMD: ========= ========= reg delete HKLM\SOFTWARE\Mozilla /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\MozillaPlugins /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {0633EE93-D776-472f-A0FF-E1416B8B2E3A} /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= The system needs a manual reboot. ==== End of Fixlog ====