Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-05-2014 Ran by Szymon at 2014-05-15 17:39:07 Run:1 Running from C:\Users\Szymon\Downloads Boot Mode: Normal ============================================== Content of fixlist: ***************** IFEO\jumpflip: [Debugger] tasklist.exe IFEO\volaro: [Debugger] tasklist.exe IFEO\vonteera: [Debugger] tasklist.exe HKLM\...\AppCertDlls: [x86] -> C:\Program Files (x86)\Settings Manager\systemk\sysapcrt.dll HKLM\...\AppCertDlls: [x64] -> C:\Program Files (x86)\Settings Manager\systemk\x64\sysapcrt.dll GroupPolicy: Group Policy on Chrome detected <======= ATTENTION Task: {2FED2350-3583-400B-8322-CA541957DC1C} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: {3674A1DD-3F5D-454B-B692-DD0FCD0ED809} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: {763D8AC0-D1F8-4977-9652-D1C2DB7E9295} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe HKU\S-1-5-21-1706887735-24700494-238556219-1000\...\Run: [ALLUpdate] => "F:\ALLPlayer\ALLUpdate.exe" "sleep" HKU\S-1-5-21-1706887735-24700494-238556219-1000\...\Run: [ChicaPasswordManager] => "C:\Program Files (x86)\ChicaLogic\Chica Password Manager\stpass.exe" /autorunned HKU\S-1-5-21-1706887735-24700494-238556219-1000\...\Run: [ChomikBox] => C:\Program Files (x86)\ChomikBox\ChomikBox.exe HKU\S-1-5-21-1706887735-24700494-238556219-1000\...\Run: [SpeedUpMyComputer] => C:\Program Files (x86)\SmartTweak\SpeedUpMyComputer\SpeedUpMyComputer.exe /ot /as /ss HKU\S-1-5-21-1706887735-24700494-238556219-1000\...\Run: [FixMyRegistry] => C:\Program Files (x86)\SmartTweak\FixMyRegistry\FixMyRegistry.exe /ot /as /ss S2 TBPanel; No ImagePath S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.default-search.net?sid=492&aid=109&itype=a&ver=12521&tm=302&src=hmp HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.awesomehp.com/web/?type=ds&ts=1395594888&from=amt&uid=ST31000528AS_9VP1CBR6XXXX9VP1CBR6&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=pl&pid=NAV&pvid=21.2.0.38 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,SearchURL = http://home.microsoft.com/access/autosearch.asp?p=%s HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=109&itype=a&ver=12521&tm=302&src=ds&p={searchTerms} SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=109&itype=a&ver=12521&tm=302&src=ds&p={searchTerms} SearchScopes: HKCU - DefaultScope Software\Microsoft\Internet Explorer\SearchScopes URL = SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=109&itype=a&ver=12521&tm=302&src=ds&p={searchTerms} BHO-x32: No Name - {A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} - No File AlternateDataStreams: C:\ProgramData\TEMP:56E2E879 C:\extensions.ini C:\Program Files\AdTrustMedia C:\Program Files\Enigma Software Group C:\Program Files (x86)\MediaBuzzV1 C:\Program Files (x86)\RichMediaViewV1 C:\Program Files (x86)\Settings Manager C:\Program Files (x86)\SmartTweak C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308} C:\ProgramData\Adtrustmedia C:\ProgramData\AVG C:\ProgramData\RegClean C:\ProgramData\Wincert C:\ProgramData\WPM C:\Users\Public\Documents\GOOBZO C:\Users\Public\Documents\ShopperPro C:\Users\Szymon\.android C:\Users\Szymon\daemonprocess.txt C:\Users\Szymon\AppData\Local\34f9935e-e09f-4f97-549b-397028a012df C:\Users\Szymon\AppData\Local\AdTrustMedia C:\Users\Szymon\AppData\Local\AVG C:\Users\Szymon\AppData\Local\cache C:\Users\Szymon\AppData\Local\CrashRpt C:\Users\Szymon\AppData\Local\Mobogenie C:\Users\Szymon\AppData\Local\UpdateChecker C:\Users\Szymon\AppData\Roaming\AVG C:\Users\Szymon\AppData\Roaming\rmi C:\Users\Szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SmartTweak Software C:\Users\Szymon\AppData\Roaming\SupTab C:\Users\Szymon\Documents\Mobogenie C:\Users\Szymon\Documents\Optimizer Pro C:\Users\Szymon\Downloads\309271-*.exe C:\Users\Szymon\Downloads\Nero_7_Sciagnij.pl*.exe C:\Users\Szymon\Downloads\Niepotwierdzony 821505.crdownload C:\Users\Szymon\Downloads\SpyHunter-Installer.exe C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP C:\Windows\system32\unrar64.dll C:\Windows\SysWOW64\unrar.dll C:\Windows\SysWOW64\GroupPolicy\GPT.INI Reg: reg delete HKCU\Software\Mozilla /f Reg: reg delete HKLM\SOFTWARE\Mozilla /f Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\mozilla.org /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f ***************** HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\jumpflip => Key deleted successfully. HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\volaro => Key deleted successfully. HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\vonteera => Key deleted successfully. HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls\\x86 => Value deleted successfully. HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls\\x64 => Value deleted successfully. C:\Windows\system32\GroupPolicy\Machine => Moved successfully. C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2FED2350-3583-400B-8322-CA541957DC1C} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2FED2350-3583-400B-8322-CA541957DC1C} => Key deleted successfully. C:\Windows\System32\Tasks\APSnotifierPP3 => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP3 => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3674A1DD-3F5D-454B-B692-DD0FCD0ED809} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3674A1DD-3F5D-454B-B692-DD0FCD0ED809} => Key deleted successfully. C:\Windows\System32\Tasks\APSnotifierPP2 => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP2 => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{763D8AC0-D1F8-4977-9652-D1C2DB7E9295} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{763D8AC0-D1F8-4977-9652-D1C2DB7E9295} => Key deleted successfully. C:\Windows\System32\Tasks\APSnotifierPP1 => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP1 => Key deleted successfully. C:\Windows\Tasks\APSnotifierPP1.job => Moved successfully. C:\Windows\Tasks\APSnotifierPP2.job => Moved successfully. C:\Windows\Tasks\APSnotifierPP3.job => Moved successfully. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\mobilegeni daemon => Value deleted successfully. HKU\S-1-5-21-1706887735-24700494-238556219-1000\Software\Microsoft\Windows\CurrentVersion\Run\\ALLUpdate => Value deleted successfully. HKU\S-1-5-21-1706887735-24700494-238556219-1000\Software\Microsoft\Windows\CurrentVersion\Run\\ChicaPasswordManager => Value deleted successfully. HKU\S-1-5-21-1706887735-24700494-238556219-1000\Software\Microsoft\Windows\CurrentVersion\Run\\ChomikBox => Value deleted successfully. HKU\S-1-5-21-1706887735-24700494-238556219-1000\Software\Microsoft\Windows\CurrentVersion\Run\\SpeedUpMyComputer => Value deleted successfully. HKU\S-1-5-21-1706887735-24700494-238556219-1000\Software\Microsoft\Windows\CurrentVersion\Run\\FixMyRegistry => Value deleted successfully. TBPanel => Service deleted successfully. esgiguard => Service deleted successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Search Bar => Value deleted successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Bar => Value deleted successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\CustomizeSearch => Value deleted successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\SearchURL => Value deleted successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\SearchAssistant => Value deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key deleted successfully. HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key deleted successfully. HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} => Key not found. C:\ProgramData\TEMP => ":56E2E879" ADS removed successfully. C:\extensions.ini => Moved successfully. C:\Program Files\AdTrustMedia => Moved successfully. C:\Program Files\Enigma Software Group => Moved successfully. C:\Program Files (x86)\MediaBuzzV1 => Moved successfully. C:\Program Files (x86)\RichMediaViewV1 => Moved successfully. C:\Program Files (x86)\Settings Manager => Moved successfully. C:\Program Files (x86)\SmartTweak => Moved successfully. C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308} => Moved successfully. C:\ProgramData\Adtrustmedia => Moved successfully. C:\ProgramData\AVG => Moved successfully. C:\ProgramData\RegClean => Moved successfully. C:\ProgramData\Wincert => Moved successfully. C:\ProgramData\WPM => Moved successfully. C:\Users\Public\Documents\GOOBZO => Moved successfully. C:\Users\Public\Documents\ShopperPro => Moved successfully. C:\Users\Szymon\.android => Moved successfully. C:\Users\Szymon\daemonprocess.txt => Moved successfully. C:\Users\Szymon\AppData\Local\34f9935e-e09f-4f97-549b-397028a012df => Moved successfully. C:\Users\Szymon\AppData\Local\AdTrustMedia => Moved successfully. C:\Users\Szymon\AppData\Local\AVG => Moved successfully. C:\Users\Szymon\AppData\Local\cache => Moved successfully. C:\Users\Szymon\AppData\Local\CrashRpt => Moved successfully. C:\Users\Szymon\AppData\Local\Mobogenie => Moved successfully. "C:\Users\Szymon\AppData\Local\UpdateChecker" directory move: C:\Users\Szymon\AppData\Local\UpdateChecker\UpdateCheckerApp.exe => Moved successfully. C:\Users\Szymon\AppData\Local\UpdateChecker\UpdaterLibrary.dll => Moved successfully. Could not move "C:\Users\Szymon\AppData\Local\UpdateChecker" directory. => Scheduled to move on reboot. C:\Users\Szymon\AppData\Roaming\AVG => Moved successfully. C:\Users\Szymon\AppData\Roaming\rmi => Moved successfully. C:\Users\Szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SmartTweak Software => Moved successfully. C:\Users\Szymon\AppData\Roaming\SupTab => Moved successfully. C:\Users\Szymon\Documents\Mobogenie => Moved successfully. C:\Users\Szymon\Documents\Optimizer Pro => Moved successfully. C:\Users\Szymon\Downloads\309271-*.exe => Moved successfully. C:\Users\Szymon\Downloads\Nero_7_Sciagnij.pl*.exe => Moved successfully. C:\Users\Szymon\Downloads\Niepotwierdzony 821505.crdownload => Moved successfully. C:\Users\Szymon\Downloads\SpyHunter-Installer.exe => Moved successfully. C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP => Moved successfully. C:\Windows\system32\unrar64.dll => Moved successfully. C:\Windows\SysWOW64\unrar.dll => Moved successfully. C:\Windows\SysWOW64\GroupPolicy\GPT.INI => Moved successfully. ========= reg delete HKCU\Software\Mozilla /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Mozilla /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\MozillaPlugins /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f ========= Bť¤D: Odmowa dost©pu. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\mozilla.org /f ========= Bť¤D: System nie znalazˆ w rejestrze okre˜lonego klucza albo warto˜ci. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= => Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-05-15 17:41:26)<= C:\Users\Szymon\AppData\Local\UpdateChecker => Moved successfully. ==== End of Fixlog ====