Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 26-02-2014 01 Ran by Dominik at 2014-02-27 13:46:23 Run:1 Running from C:\Documents and Settings\Dominik\Moje dokumenty\Downloads Boot Mode: Normal ============================================== Content of fixlist: ***************** ShortcutWithArgument: C:\Documents and Settings\All Users\Menu Start\Programy\Google Chrome\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=sc&from=smt&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&ts=1381688728 ShortcutWithArgument: C:\Documents and Settings\Dominik\Menu Start\Programy\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=sc&from=smt&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&ts=1381688728 ShortcutWithArgument: C:\Documents and Settings\Dominik\Menu Start\Programy\Akcesoria\Narzędzia systemowe\Internet Explorer (bez dodatków).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=sc&from=smt&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&ts=1381688728 ShortcutWithArgument: C:\Documents and Settings\Dominik\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=sc&from=smt&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&ts=1381688728 ShortcutWithArgument: C:\Documents and Settings\Dominik\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Uruchom przeglądarkę Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=sc&from=smt&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&ts=1381688728 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&ts=1381688728 HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www.searchgol.com/?babsrc=HP_ss&mntrId=1C0500E04C80D138&affID=125032&tsp=5034 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&ts=1381688728 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&ts=1381688728 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?type=ds&ts=1388677904&from=wpm0102&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?type=ds&ts=1388677904&from=wpm0102&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=hp&from=smt&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&ts=1381688728 StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.dosearches.com/?utm_source=b&utm_medium=smt&utm_campaign=eXQ&utm_content=sc&from=smt&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&ts=1381688728 SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388677904&from=wpm0102&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&q={searchTerms} SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388677904&from=wpm0102&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&q={searchTerms} SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388677904&from=wpm0102&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&q={searchTerms} SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.searchgol.com/?q={searchTerms}&babsrc=SP_ss&mntrId=1C0500E04C80D138&affID=125032&tsp=5034 SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388677904&from=wpm0102&uid=WDCXWD800BB-00FJA0_WD-WCAJ92476405&q={searchTerms} CHR HKLM\...\Chrome\Extension: [aipfmkinhleccnodemkoofnnofpbbpac] - C:\Documents and Settings\Dominik\Dane aplikacji\BabSolution\CR\searchgol.crx [2013-09-10] CHR HKLM\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Documents and Settings\Dominik\Dane aplikacji\BabSolution\CR\Delta.crx [2013-09-10] CHR HKLM\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Documents and Settings\Dominik\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\newtab.crx [2013-10-13] HKLM\...\Run: [EasyTuneIV] - C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\ET4\et4Tray.exe HKLM\...\Run: [tuto4pc_pl_8] - [X] HKLM\...\Run: [avgnt] - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min HKLM\...\Run: [tuto4pc_pl_31] - [X] HKLM\...\Run: [tuto4pc_pl_32] - [X] HKU\.DEFAULT\...\Winlogon: [Userinit] [[%%INSTALLTIME%%]] HKU\.DEFAULT\...\Winlogon: [Shell] [[%%INSTALLTIME%%]] HKU\S-1-5-19\...\Winlogon: [Userinit] [[%%INSTALLTIME%%]] HKU\S-1-5-19\...\Winlogon: [Shell] [[%%INSTALLTIME%%]] HKU\S-1-5-20\...\Winlogon: [Userinit] [[%%INSTALLTIME%%]] HKU\S-1-5-20\...\Winlogon: [Shell] [[%%INSTALLTIME%%]] HKU\S-1-5-21-602162358-412668190-839522115-1004\...\Run: [Hoolapp Android] - "C:\DOCUME~1\Dominik\DANEAP~1\HOOLAP~1\Hoolapp.exe" /Minimized HKU\S-1-5-21-602162358-412668190-839522115-1004\...\Winlogon: [Userinit] [[%%INSTALLTIME%%]] HKU\S-1-5-21-602162358-412668190-839522115-1004\...\Winlogon: [Shell] [[%%INSTALLTIME%%]] AppInit_DLLs: c:\docume~1\alluse~1\daneap~1\bitguard\271832~1.68\{c16c1~1\bitguard.dll => c:\docume~1\alluse~1\daneap~1\bitguard\271832~1.68\{c16c1~1\bitguard.dll File Not Found S2 Wpm; C:\Documents and Settings\All Users\Dane aplikacji\WPM\wprotectmanager.exe -service [X] S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X] C:\Documents and Settings\All Users\Dane aplikacji\Babylon C:\Documents and Settings\All Users\Dane aplikacji\eSafe C:\Documents and Settings\All Users\Dane aplikacji\IBUpdaterService C:\Documents and Settings\All Users\Dane aplikacji\McAfee C:\Documents and Settings\All Users\Dane aplikacji\WPM C:\Documents and Settings\Dominik\Dane aplikacji\1H1E1R1Q1I C:\Documents and Settings\Dominik\Dane aplikacji\BabSolution C:\Documents and Settings\Dominik\Dane aplikacji\Babylon C:\Documents and Settings\Dominik\Dane aplikacji\DSite C:\Documents and Settings\Dominik\Dane aplikacji\Funmoods C:\Documents and Settings\Dominik\Dane aplikacji\HoolappForAndroid C:\Documents and Settings\Dominik\Dane aplikacji\PerformerSoft C:\Documents and Settings\Dominik\Ustawienia lokalne\Dane aplikacji\tuto4pc_pl_8 C:\Program Files\tuto4pc_pl_32 C:\Program Files\tuto4pc_pl_31 Reg: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Search" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java" /f ***************** C:\Documents and Settings\All Users\Menu Start\Programy\Google Chrome\Google Chrome.lnk => Shortcut argument was removed successfully. C:\Documents and Settings\Dominik\Menu Start\Programy\Internet Explorer.lnk => Shortcut argument was removed successfully. C:\Documents and Settings\Dominik\Menu Start\Programy\Akcesoria\Narzędzia systemowe\Internet Explorer (bez dodatków).lnk => Shortcut argument was removed successfully. C:\Documents and Settings\Dominik\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk => Shortcut argument was removed successfully. C:\Documents and Settings\Dominik\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Uruchom przeglądarkę Internet Explorer.lnk => Shortcut argument was removed successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\bProtector Start Page => Value deleted successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\bProtectorDefaultScope => Value deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKLM\SOFTWARE\Google\Chrome\Extensions\aipfmkinhleccnodemkoofnnofpbbpac => Key deleted successfully. "C:\Documents and Settings\Dominik\Dane aplikacji\BabSolution\CR\searchgol.crx" => File/Directory not found. HKLM\SOFTWARE\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde => Key deleted successfully. "C:\Documents and Settings\Dominik\Dane aplikacji\BabSolution\CR\Delta.crx" => File/Directory not found. HKLM\SOFTWARE\Google\Chrome\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo => Key deleted successfully. C:\Documents and Settings\Dominik\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\newtab.crx => Moved successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\EasyTuneIV => Value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\tuto4pc_pl_8 => Value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\avgnt => Value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\tuto4pc_pl_31 => Value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\tuto4pc_pl_32 => Value deleted successfully. HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit => Value deleted successfully. HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully. HKU\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit => Value deleted successfully. HKU\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully. HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit => Value deleted successfully. HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully. HKU\S-1-5-21-602162358-412668190-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Run\\Hoolapp Android => Value deleted successfully. HKU\S-1-5-21-602162358-412668190-839522115-1004\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit => Value deleted successfully. HKU\S-1-5-21-602162358-412668190-839522115-1004\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully. "c:\\docume~1\\alluse~1\\daneap~1\\bitguard\\271832~1.68\\{c16c1~1\\bitguard.dll" => Value Data removed successfully. Wpm => Service deleted successfully. hwdatacard => Service deleted successfully. C:\Documents and Settings\All Users\Dane aplikacji\Babylon => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\eSafe => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\IBUpdaterService => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\McAfee => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\WPM => Moved successfully. C:\Documents and Settings\Dominik\Dane aplikacji\1H1E1R1Q1I => Moved successfully. C:\Documents and Settings\Dominik\Dane aplikacji\BabSolution => Moved successfully. C:\Documents and Settings\Dominik\Dane aplikacji\Babylon => Moved successfully. C:\Documents and Settings\Dominik\Dane aplikacji\DSite => Moved successfully. C:\Documents and Settings\Dominik\Dane aplikacji\Funmoods => Moved successfully. C:\Documents and Settings\Dominik\Dane aplikacji\HoolappForAndroid => Moved successfully. C:\Documents and Settings\Dominik\Dane aplikacji\PerformerSoft => Moved successfully. C:\Documents and Settings\Dominik\Ustawienia lokalne\Dane aplikacji\tuto4pc_pl_8 => Moved successfully. C:\Program Files\tuto4pc_pl_32 => Moved successfully. C:\Program Files\tuto4pc_pl_31 => Moved successfully. ========= reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Search" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ==== End of Fixlog ====