Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 28-09-2014 Ran by admin at 2014-09-30 13:25:20 Run:1 Running from C:\Documents and Settings\admin\Pulpit\stawiamy na nogi kompa\Nowy folder Loaded Profile: admin (Available profiles: admin & Administrator) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: U1 eabfiltr; No ImagePath HKLM\...\Run: [LaunchList] => C:\Program Files\Pinnacle\Studio 8\LaunchList.exe HKU\S-1-5-21-1343024091-1454471165-1417001333-1006\...\Run: [Hoolapp Android] => "C:\DOCUME~1\admin\DANEAP~1\HOOLAP~1\Hoolapp.exe" /Minimized HKU\S-1-5-21-1343024091-1454471165-1417001333-1006\...\Run: [ares] => "C:\Program Files\Ares\Ares.exe" -h HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/413 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.funmoods.com/?f=1&a=iron2&chnl=iron2&cd=2XzuyEtN2Y1L1QzutDtDtC0AyBtAtDtCtDyC0Ezy0E0FtAtCtN0D0Tzu0CtBtAzztN1L2XzutBtFtCtFtCtFtAtCtB&cr=1591006633 SearchScopes: HKLM - Backup.Old.DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=iron2&chnl=iron2&cd=2XzuyEtN2Y1L1QzutDtDtC0AyBtAtDtCtDyC0Ezy0E0FtAtCtN0D0Tzu0CtBtAzztN1L2XzutBtFtCtFtCtFtAtCtB&cr=1591006633 SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms} SearchScopes: HKCU - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms} SearchScopes: HKCU - Backup.Old.DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=iron2&chnl=iron2&cd=2XzuyEtN2Y1L1QzutDtDtC0AyBtAtDtCtDyC0Ezy0E0FtAtCtN0D0Tzu0CtBtAzztN1L2XzutBtFtCtFtCtFtAtCtB&cr=1591006633 SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms} BHO: Funmoods Helper Object -> {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} -> C:\PROGRA~1\Funmoods\1.5.23.22\bh\escort.dll No File Toolbar: HKLM - Funmoods Toolbar - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - C:\PROGRA~1\Funmoods\1.5.23.22\escorTlbr.dll No File FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension C:\Documents and Settings\admin\Dane aplikacji\Betcat C:\Documents and Settings\admin\Dane aplikacji\FreeFLVConverter C:\Documents and Settings\admin\Dane aplikacji\HoolappForAndroid C:\Documents and Settings\admin\Dane aplikacji\OpenCandy C:\Documents and Settings\admin\Dane aplikacji\searchquband C:\Documents and Settings\admin\Dane aplikacji\TuneUp Software C:\Documents and Settings\admin\Dane aplikacji\Web Cake C:\Documents and Settings\admin\Ustawienia lokalne\Dane aplikacji\funmoods.crx C:\Documents and Settings\admin\Ustawienia lokalne\Dane aplikacji\funmoods-speeddial.crx C:\Documents and Settings\admin\Ustawienia lokalne\Dane aplikacji\Google C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\{32364CEA-7855-4A3C-B674-53D8E9B97936} C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Babylon C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\boost_interprocess C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Common Files C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\InstallMate C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Tarma Installer C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\TuneUp Software C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.000\Dane aplikacji\TuneUp Software C:\Program Files\Google C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension Reg: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{69FFBE3B-83EA-22C6-4B5D-241A5CC90557}" /f Reg: reg delete "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{69FFBE3B-83EA-22C6-4B5D-241A5CC90557}" /f Reg: reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {0633EE93-D776-472f-A0FF-E1416B8B2E3A} /f Reg: reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" /f Reg: reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" /ve /t REG_SZ /d Bing /f Reg: reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" /v URL /t REG_SZ /d "http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC" /f Reg: reg delete HKCU\Software\Google /f Reg: reg delete HKLM\SOFTWARE\Google /f CMD: sc delete gupdate EmptyTemp: ***************** Processes closed successfully. eabfiltr => Service deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\LaunchList => value deleted successfully. HKU\S-1-5-21-1343024091-1454471165-1417001333-1006\Software\Microsoft\Windows\CurrentVersion\Run\\Hoolapp Android => value deleted successfully. HKU\S-1-5-21-1343024091-1454471165-1417001333-1006\Software\Microsoft\Windows\CurrentVersion\Run\\ares => value deleted successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\Backup.Old.DefaultScope => value deleted successfully. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully. "HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}" => Key deleted successfully. "HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}" => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\Backup.Old.DefaultScope => value deleted successfully. "HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully. "HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found. "HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}" => Key deleted successfully. "HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}" => Key not found. "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}" => Key deleted successfully. "HKCR\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}" => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} => value deleted successfully. "HKCR\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}" => Key deleted successfully. HKLM\Software\Mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b} => value deleted successfully. C:\Documents and Settings\admin\Dane aplikacji\Betcat => Moved successfully. C:\Documents and Settings\admin\Dane aplikacji\FreeFLVConverter => Moved successfully. C:\Documents and Settings\admin\Dane aplikacji\HoolappForAndroid => Moved successfully. C:\Documents and Settings\admin\Dane aplikacji\OpenCandy => Moved successfully. C:\Documents and Settings\admin\Dane aplikacji\searchquband => Moved successfully. C:\Documents and Settings\admin\Dane aplikacji\TuneUp Software => Moved successfully. C:\Documents and Settings\admin\Dane aplikacji\Web Cake => Moved successfully. C:\Documents and Settings\admin\Ustawienia lokalne\Dane aplikacji\funmoods.crx => Moved successfully. C:\Documents and Settings\admin\Ustawienia lokalne\Dane aplikacji\funmoods-speeddial.crx => Moved successfully. C:\Documents and Settings\admin\Ustawienia lokalne\Dane aplikacji\Google => Moved successfully. C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\{32364CEA-7855-4A3C-B674-53D8E9B97936} => Moved successfully. C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Babylon => Moved successfully. C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\boost_interprocess => Moved successfully. C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Common Files => Moved successfully. C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\InstallMate => Moved successfully. C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Tarma Installer => Moved successfully. C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\TuneUp Software => Moved successfully. C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.000\Dane aplikacji\TuneUp Software => Moved successfully. C:\Program Files\Google => Moved successfully. C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension => Moved successfully. ========= reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{69FFBE3B-83EA-22C6-4B5D-241A5CC90557}" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{69FFBE3B-83EA-22C6-4B5D-241A5CC90557}" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {0633EE93-D776-472f-A0FF-E1416B8B2E3A} /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" /ve /t REG_SZ /d Bing /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" /v URL /t REG_SZ /d "http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete HKCU\Software\Google /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Google /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= sc delete gupdate ========= [SC] DeleteService SUCCESS ========= End of CMD: ========= EmptyTemp: => Removed 2.6 GB temporary data. The system needed a reboot. ==== End of Fixlog ====