Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 26-02-2014 01 Ran by Klaudia at 2014-02-27 01:00:18 Run:1 Running from C:\Users\Klaudia\Desktop\logi\frst Boot Mode: Normal ============================================== Content of fixlist: ***************** (Cherished Technololgy LIMITED) C:\ProgramData\IePluginService\PluginService.exe () C:\Users\Klaudia\AppData\Local\fst_pl_41\upfst_pl_41.exe () C:\Program Files\FindRight\updateFindRight.exe () C:\Program Files\FindRight\FindRight.FirstRun.exe () C:\Program Files\FindRight\bin\utilFindRight.exe (Cherished Technololgy LIMITED) C:\ProgramData\WPM\wprotectmanager.exe (Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files\WinZipper\winzipersvc.exe R2 IePluginService; C:\ProgramData\IePluginService\PluginService.exe [508016 2014-01-14] (Cherished Technololgy LIMITED) R2 Update FindRight; C:\Program Files\FindRight\updateFindRight.exe [111904 2014-02-26] () R2 Util FindRight; C:\Program Files\FindRight\bin\utilFindRight.exe [111904 2014-02-26] () R2 winzipersvc; C:\Program Files\WinZipper\winzipersvc.exe [425104 2014-02-26] (Taiwan Shui Mu Chih Ching Technology Limited.) R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [501904 2014-02-26] (Cherished Technololgy LIMITED) Task: {A43614D3-6EB2-422D-A9A7-199E0DE7ACE7} - System32\Tasks\bench-S-1-5-21-153922561-2302829751-298388780-1000 => C:\Program Files\Bench\Updater\updater.exe [2013-12-18] () <==== ATTENTION Task: {C1763D8F-BB09-4F4B-A9CC-D8385F2294E2} - System32\Tasks\bench-sys => C:\Program Files\Bench\Updater\updater.exe [2013-12-18] () <==== ATTENTION Task: C:\Windows\Tasks\bench-S-1-5-21-153922561-2302829751-298388780-1000.job => C:\Program Files\Bench\Updater\updater.exe <==== ATTENTION Task: C:\Windows\Tasks\bench-sys.job => C:\Program Files\Bench\Updater\updater.exe <==== ATTENTION HKLM\...\Runonce: [Discount Dragon-repairJob] - wscript.exe "C:\Users\Klaudia\AppData\Local\Discount Dragon\repair.js" "Discount Dragon-repairJob" HKLM\...\RunOnce: [upfst_pl_41.exe] - C:\Users\Klaudia\AppData\Local\fst_pl_41\upfst_pl_41.exe -runonce [3154416 2014-01-27] () HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=ST9160310AS_5SV4QZWC&ts=1393425915 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=ST9160310AS_5SV4QZWC&ts=1393425915 HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST9160310AS_5SV4QZWC&ts=1393425915&type=default&q={searchTerms} HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST9160310AS_5SV4QZWC&ts=1393425915&type=default&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=ST9160310AS_5SV4QZWC&ts=1393425915 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=ST9160310AS_5SV4QZWC&ts=1393425915 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.awesomehp.com/web/?type=ds&ts=1391677571&from=tt4u&uid=ST9160310AS_5SV4QZWC&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.awesomehp.com/web/?type=ds&ts=1391677571&from=tt4u&uid=ST9160310AS_5SV4QZWC&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.awesomehp.com/?type=sc&ts=1391677571&from=tt4u&uid=ST9160310AS_5SV4QZWC SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {E64D9622-0737-4057-8227-8F54F970F5CE} URL = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1602&query={searchTerms}&invocationType=tb50hpcnnbie7-pl-pl SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={sear SearchScopes: HKCU - {E64D9622-0737-4057-8227-8F54F970F5CE} URL = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1602&query={searchTerms}&invocationType=tb50hpcnnbie7-pl-pl BHO: FindRight - {2c774641-5504-46a8-b63f-6715ae3fe376} - C:\Program Files\FindRight\FindRightBHO.dll (FindRight) BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files\SupTab\SupTab.dll (Thinknice Co. Limited) BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\Pasek narzędzi AOL 5.0\aoltb.dll (AOL LLC) BHO: No Name - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File Toolbar: HKLM - AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\Pasek narzędzi AOL 5.0\aoltb.dll (AOL LLC) Toolbar: HKCU - AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\Pasek narzędzi AOL 5.0\aoltb.dll (AOL LLC) 54.204.28.26 nikdaiaidiiiogaidkkekcmokcgcdeac GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\Klaudia\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx [2014-02-26] CHR HKLM\...\Chrome\Extension: [ogfjmhfnldnajmfaofeiaepghjenbgjo] - C:\Users\Klaudia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ep.crx [2014-02-26] CHR StartMenuInternet: Google Chrome - C:\Program Files\Google\Chrome\Application\chrome.exe http://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=sc&from=wpm0226&uid=ST9160310AS_5SV4QZWC&ts=1393425915 ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=sc&from=wpm0226&uid=ST9160310AS_5SV4QZWC&ts=1393425915 ShortcutWithArgument: C:\Users\Klaudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=sc&from=wpm0226&uid=ST9160310AS_5SV4QZWC&ts=1393425915 ShortcutWithArgument: C:\Users\Klaudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=sc&from=wpm0226&uid=ST9160310AS_5SV4QZWC&ts=1393425915 ShortcutWithArgument: C:\Users\Klaudia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=sc&from=wpm0226&uid=ST9160310AS_5SV4QZWC&ts=1393425915 ShortcutWithArgument: C:\Users\Klaudia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=sc&from=wpm0226&uid=ST9160310AS_5SV4QZWC&ts=1393425915 ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=sc&from=wpm0226&uid=ST9160310AS_5SV4QZWC&ts=1393425915 C:\Program Files\Cling Clang C:\Program Files\Mobogenie C:\Users\Klaudia\.android C:\Users\Klaudia\AppData\Local\cache C:\Users\Klaudia\AppData\Local\genienext C:\Users\Klaudia\AppData\Local\Mobogenie C:\Users\Klaudia\AppData\Roaming\awesomehp C:\Users\Klaudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop C:\Users\Klaudia\Documents\Mobogenie C:\Users\Klaudia\Downloads\Audacity(11826).exe C:\Windows\system32\DOErrors.log Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ***************** [1924] C:\ProgramData\IePluginService\PluginService.exe => Process closed successfully. [3832] C:\Users\Klaudia\AppData\Local\fst_pl_41\upfst_pl_41.exe => Process closed successfully. [4456] C:\Program Files\FindRight\updateFindRight.exe => Process closed successfully. [5360] C:\Program Files\FindRight\FindRight.FirstRun.exe => Process closed successfully. [5296] C:\Program Files\FindRight\bin\utilFindRight.exe => Process closed successfully. [6836] C:\ProgramData\WPM\wprotectmanager.exe => Process closed successfully. [1988] C:\Program Files\WinZipper\winzipersvc.exe => Process closed successfully. IePluginService => Service deleted successfully. Update FindRight => Service deleted successfully. Util FindRight => Service deleted successfully. winzipersvc => Service deleted successfully. Wpm => Service deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A43614D3-6EB2-422D-A9A7-199E0DE7ACE7} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A43614D3-6EB2-422D-A9A7-199E0DE7ACE7} => Key deleted successfully. C:\Windows\System32\Tasks\bench-S-1-5-21-153922561-2302829751-298388780-1000 => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\bench-S-1-5-21-153922561-2302829751-298388780-1000 => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C1763D8F-BB09-4F4B-A9CC-D8385F2294E2} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C1763D8F-BB09-4F4B-A9CC-D8385F2294E2} => Key deleted successfully. C:\Windows\System32\Tasks\bench-sys => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\bench-sys => Key deleted successfully. C:\Windows\Tasks\bench-S-1-5-21-153922561-2302829751-298388780-1000.job => Moved successfully. C:\Windows\Tasks\bench-sys.job => Moved successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Discount Dragon-repairJob => Value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\upfst_pl_41.exe => Value deleted successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Search Bar => Value deleted successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Local Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E64D9622-0737-4057-8227-8F54F970F5CE} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{E64D9622-0737-4057-8227-8F54F970F5CE} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E64D9622-0737-4057-8227-8F54F970F5CE} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{E64D9622-0737-4057-8227-8F54F970F5CE} => Key not found. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2c774641-5504-46a8-b63f-6715ae3fe376} => Key deleted successfully. HKCR\CLSID\{2c774641-5504-46a8-b63f-6715ae3fe376} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} => Key deleted successfully. HKCR\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9} => Key deleted successfully. HKCR\CLSID\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045} => Key deleted successfully. HKCR\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045} => Key not found. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{DE9C389F-3316-41A7-809B-AA305ED9D922} => Value deleted successfully. HKCR\CLSID\{DE9C389F-3316-41A7-809B-AA305ED9D922} => Key deleted successfully. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{DE9C389F-3316-41A7-809B-AA305ED9D922} => Value deleted successfully. HKCR\CLSID\{DE9C389F-3316-41A7-809B-AA305ED9D922} => Key not found. C:\Windows\system32\GroupPolicy\Machine => Moved successfully. C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully. HKLM\SOFTWARE\Google\Chrome\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo => Key deleted successfully. C:\Users\Klaudia\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx => Moved successfully. HKLM\SOFTWARE\Google\Chrome\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo => Key deleted successfully. C:\Users\Klaudia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ep.crx => Moved successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command\\Default => Value was restored successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk => Shortcut argument was removed successfully. C:\Users\Klaudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk => Shortcut argument was removed successfully. C:\Users\Klaudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk => Shortcut argument was restored successfully. C:\Users\Klaudia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk => Shortcut argument was removed successfully. C:\Users\Klaudia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk => Shortcut argument was removed successfully. C:\Users\Public\Desktop\Google Chrome.lnk => Shortcut argument was removed successfully. C:\Program Files\Cling Clang => Moved successfully. C:\Program Files\Mobogenie => Moved successfully. C:\Users\Klaudia\.android => Moved successfully. C:\Users\Klaudia\AppData\Local\cache => Moved successfully. C:\Users\Klaudia\AppData\Local\genienext => Moved successfully. C:\Users\Klaudia\AppData\Local\Mobogenie => Moved successfully. C:\Users\Klaudia\AppData\Roaming\awesomehp => Moved successfully. C:\Users\Klaudia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop => Moved successfully. C:\Users\Klaudia\Documents\Mobogenie => Moved successfully. C:\Users\Klaudia\Downloads\Audacity(11826).exe => Moved successfully. C:\Windows\system32\DOErrors.log => Moved successfully. ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= The system needs a manual reboot. ==== End of Fixlog ====