Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-09-2014 02 Ran by Marcin at 2014-09-05 15:25:07 Run:2 Running from C:\Users\Marcin\Downloads Boot Mode: Normal ============================================== Content of fixlist: ***************** () C:\Users\Marcin\Downloads\AdwCleaner.pl 3.308.exe HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [CMD] => cmd.exe /k if %date:~6,4%%date:~3,2%%date:~0,2% LEQ 20140911 (exit) else (start http://farmaster.net/ && exit) HKLM\...\Policies\Explorer: [NoFolderOptions] 0 HKLM\...\Policies\Explorer: [NoControlPanel] 0 HKLM\...\Policies\Explorer: [HideSCAHealth] 1 SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = FF Plugin-x32: @esn.me/esnsonar,version=0.70.0 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll No File FF Plugin HKCU: ubisoft.com/uplaypc -> D:\Gry\Trials Evolution Gold Edition\datapack\orbit\npuplaypc.dll No File S3 dgderdrv; System32\drivers\dgderdrv.sys [X] S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [X] HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service" CMD: type C:\Windows\System32\Tasks\QtraxPlayer1 Task: {06E5205F-E4FD-4CC9-BA12-8A8566CEF235} - System32\Tasks\QtraxPlayer1 => C:\Program Files (x86)\Microsoft Silverlight\sllauncher.exe [2014-02-13] (Microsoft Corporation) Task: {21A7BDBB-4706-4B61-9F13-9729274CAB29} - System32\Tasks\{730E1798-D897-4054-8012-CEA44F66FEF5} => Firefox.exe http://ui.skype.com/ui/0/5.1.0.112.259/en/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;alreadyoffered Task: {2A042F92-CEA2-42ED-8971-E4157A54FAA1} - System32\Tasks\{DB4DE19C-72E4-457E-A1F4-290437682852} => Firefox.exe http://ui.skype.com/ui/0/5.3.0.111.259/en/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;alreadyoffered Task: {323DDE43-2BBA-46C9-BD1C-C83C7F4AA5EE} - System32\Tasks\{1AB6011F-3641-4F58-9011-F1F13721199E} => Firefox.exe http://ui.skype.com/ui/0/5.3.0.120.259/en/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;alreadyoffered Task: {4C7FBFB5-66AF-404D-A016-7941BC3DA28A} - System32\Tasks\{F827B9C1-AE01-4B10-BF01-91CF449CDBD0} => Firefox.exe http://ui.skype.com/ui/0/5.1.0.112.259/en/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;alreadyoffered Task: {C0568A09-FB21-4CE5-A390-DB3D5D844765} - System32\Tasks\{16BBFF1B-FAF7-484E-8D33-C4B8DD48537D} => Firefox.exe http://ui.skype.com/ui/0/5.3.0.120.259/en/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:offered-installed;madedefault AlternateDataStreams: C:\ProgramData\Templates:gs5sys AlternateDataStreams: C:\Users\Marcin\Cookies:gs5sys AlternateDataStreams: C:\Users\Marcin\Szablony:gs5sys AlternateDataStreams: C:\Users\Marcin\AppData\Local\Historia:gs5sys C:\ProgramData\hash.dat C:\ProgramData\uxxadbmu.rlu C:\Users\Marcin\AppData\Local\{*} C:\Users\Marcin\AppData\Roaming\Temp C:\windows\d3dx.dat C:\windows\SysWow64\scrypt130511GeForce GT 330Mglg2tc1984w64l4.bin C:\windows\SysWow64\poclbm121016GeForce GT 330Mv1w256l4.bin Reg: reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Search" /f Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f Hosts: EmptyTemp: ***************** C:\Users\Marcin\Downloads\AdwCleaner.pl 3.308.exe => No running process found HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\CMD => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoFolderOptions => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoControlPanel => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\HideSCAHealth => value deleted successfully. "HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}" => Key deleted successfully. "HKCR\CLSID\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}" => Key not found. "HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => Key deleted successfully. "HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => Key not found. "HKLM\Software\Wow6432Node\MozillaPlugins\@esn.me/esnsonar,version=0.70.0" => Key deleted successfully. "HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc" => Key deleted successfully. D:\Gry\Trials Evolution Gold Edition\datapack\orbit\npuplaypc.dll not found. dgderdrv => Service deleted successfully. nvvad_WaveExtensible => Service deleted successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc" => Key deleted successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\MCODS" => Key deleted successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc" => Key deleted successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Network\MCODS" => Key deleted successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Network\MpfService" => Key deleted successfully. ========= type C:\Windows\System32\Tasks\QtraxPlayer1 ========= 2013-02-16T15:10:13 Marcin 2013-02-16T15:14:00 true IgnoreNew true true true false false PT10M PT1H true false true true false false false PT72H 7 "C:\Program Files (x86)\Microsoft Silverlight\sllauncher.exe" 741225283.portal.qtrax.com Marcin-Komputer\Marcin InteractiveToken LeastPrivilege ========= End of CMD: ========= "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{06E5205F-E4FD-4CC9-BA12-8A8566CEF235}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{06E5205F-E4FD-4CC9-BA12-8A8566CEF235}" => Key deleted successfully. C:\Windows\System32\Tasks\QtraxPlayer1 => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\QtraxPlayer1" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{21A7BDBB-4706-4B61-9F13-9729274CAB29}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{21A7BDBB-4706-4B61-9F13-9729274CAB29}" => Key deleted successfully. C:\Windows\System32\Tasks\{730E1798-D897-4054-8012-CEA44F66FEF5} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{730E1798-D897-4054-8012-CEA44F66FEF5}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2A042F92-CEA2-42ED-8971-E4157A54FAA1}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2A042F92-CEA2-42ED-8971-E4157A54FAA1}" => Key deleted successfully. C:\Windows\System32\Tasks\{DB4DE19C-72E4-457E-A1F4-290437682852} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{DB4DE19C-72E4-457E-A1F4-290437682852}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{323DDE43-2BBA-46C9-BD1C-C83C7F4AA5EE}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{323DDE43-2BBA-46C9-BD1C-C83C7F4AA5EE}" => Key deleted successfully. C:\Windows\System32\Tasks\{1AB6011F-3641-4F58-9011-F1F13721199E} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{1AB6011F-3641-4F58-9011-F1F13721199E}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4C7FBFB5-66AF-404D-A016-7941BC3DA28A}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4C7FBFB5-66AF-404D-A016-7941BC3DA28A}" => Key deleted successfully. C:\Windows\System32\Tasks\{F827B9C1-AE01-4B10-BF01-91CF449CDBD0} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{F827B9C1-AE01-4B10-BF01-91CF449CDBD0}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C0568A09-FB21-4CE5-A390-DB3D5D844765}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C0568A09-FB21-4CE5-A390-DB3D5D844765}" => Key deleted successfully. C:\Windows\System32\Tasks\{16BBFF1B-FAF7-484E-8D33-C4B8DD48537D} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{16BBFF1B-FAF7-484E-8D33-C4B8DD48537D}" => Key deleted successfully. "C:\ProgramData\Templates" => ":gs5sys" ADS not found. "C:\Users\Marcin\Cookies" => ":gs5sys" ADS not found. "C:\Users\Marcin\Szablony" => ":gs5sys" ADS not found. "C:\Users\Marcin\AppData\Local\Historia" => ":gs5sys" ADS not found. C:\ProgramData\hash.dat => Moved successfully. C:\ProgramData\uxxadbmu.rlu => Moved successfully. C:\Users\Marcin\AppData\Local\{*} => Moved successfully. C:\Users\Marcin\AppData\Roaming\Temp => Moved successfully. C:\windows\d3dx.dat => Moved successfully. C:\windows\SysWow64\scrypt130511GeForce GT 330Mglg2tc1984w64l4.bin => Moved successfully. C:\windows\SysWow64\poclbm121016GeForce GT 330Mv1w256l4.bin => Moved successfully. ========= reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Search" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= Hosts was reset successfully. EmptyTemp: => Removed 1.7 GB temporary data. The system needed a reboot. ==== End of Fixlog ====