Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-05-2014 02 Ran by TEST at 2014-05-28 09:54:32 Run:2 Running from C:\Users\TEST\Downloads Boot Mode: Normal ============================================== Content of fixlist: ***************** HKLM-x32\...\Run: [] => [X] SearchScopes: HKCU - {D66EE8CE-80A5-4A2F-B5CC-7A89B495D91E} URL = C:\Users\TEST\AppData\Roaming\Mozilla\Firefox\Profiles\kp38ngeg.default\searchplugins\askcom.xml C:\Users\TEST\AppData\Roaming\Mozilla\Firefox\Profiles\kp38ngeg.default\searchplugins\askcomsearch.xml C:\Users\TEST\AppData\Roaming\Mozilla\Firefox\Profiles\kp38ngeg.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} C:\Program Files (x86)\Mozilla Firefox\extensions FF HKLM\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] - FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird FF HKLM-x32\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] - FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird S3 BlueletAudio; system32\DRIVERS\blueletaudio.sys [X] Task: {CEA9A199-9CD6-44B1-9A32-89B7DB6C7055} - System32\Tasks\{6872A5D7-C8B2-4004-80F5-8D25AC345FEF} => Firefox.exe http://ui.skype.com/ui/0/5.5.0.124.280/pl/go/help.faq.installer?LastError=1618 CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater" /f CMD: sc config "Mobilny Internet. RunOuc" start= demand CMD: rd /s /q C:\Users\TEST\Downloads\FRST-OlderVersion CMD: C:\Users\TEST\Downloads\ComboFix.exe /uninstall ***************** HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D66EE8CE-80A5-4A2F-B5CC-7A89B495D91E} => Key deleted successfully. HKCR\CLSID\{D66EE8CE-80A5-4A2F-B5CC-7A89B495D91E} => Key not found. C:\Users\TEST\AppData\Roaming\Mozilla\Firefox\Profiles\kp38ngeg.default\searchplugins\askcom.xml => Moved successfully. C:\Users\TEST\AppData\Roaming\Mozilla\Firefox\Profiles\kp38ngeg.default\searchplugins\askcomsearch.xml => Moved successfully. C:\Users\TEST\AppData\Roaming\Mozilla\Firefox\Profiles\kp38ngeg.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} => Moved successfully. C:\Program Files (x86)\Mozilla Firefox\extensions => Moved successfully. HKLM\Software\Mozilla\Firefox\Extensions\\FF HKLM\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] - => Value not found. HKLM\Software\Mozilla\Thunderbird\Extensions\\eplgTb@eset.com => Value deleted successfully. HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\FF HKLM-x32\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] - => Value not found. HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com => Value deleted successfully. HKLM\Software\Wow6432Node\Mozilla\Thunderbird\Extensions\\eplgTb@eset.com => Value deleted successfully. BlueletAudio => Service deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CEA9A199-9CD6-44B1-9A32-89B7DB6C7055} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CEA9A199-9CD6-44B1-9A32-89B7DB6C7055} => Key deleted successfully. C:\Windows\System32\Tasks\{6872A5D7-C8B2-4004-80F5-8D25AC345FEF} => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6872A5D7-C8B2-4004-80F5-8D25AC345FEF} => Key deleted successfully. HKLM\SOFTWARE\Policies\Google => Key deleted successfully. C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup => Moved successfully. ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= sc config "Mobilny Internet. RunOuc" start= demand ========= [SC] ChangeServiceConfig SUKCES ========= End of CMD: ========= ========= rd /s /q C:\Users\TEST\Downloads\FRST-OlderVersion ========= ========= End of CMD: ========= ========= C:\Users\TEST\Downloads\ComboFix.exe /uninstall ========= ========= End of CMD: ========= ==== End of Fixlog ====