Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 23-11-2014 01 Ran by Gizela at 2014-11-26 11:02:40 Run:1 Running from C:\Users\Gizela\Desktop\Karolina naprawa! Loaded Profile: Gizela (Available profiles: Gizela) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: HKU\S-1-5-21-3448794057-2279744148-3698898670-1000\Software\Classes\.exe: exefile => <===== ATTENTION! HKU\S-1-5-21-3448794057-2279744148-3698898670-1000\Software\Classes\exefile: <===== ATTENTION! GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-3448794057-2279744148-3698898670-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1415133035&from=cor&uid=HitachiXHTS547550A9E384_J2100050DPN3VBDPN3VBX&q={searchTerms HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1415133035&from=cor&uid=HitachiXHTS547550A9E384_J2100050DPN3VBDPN3VBX&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3448794057-2279744148-3698898670-1000 -> {724893F4-3AC6-4B99-8599-45F2BDBB2D42} URL = http://www.search.ask.com/web?tpid=ORJ-SPE&o=APN11406&pf=V7&p2=^BBE^OSJ000^YY^PL&gct=&itbv=12.18.0.82&apn_uid=20202F2B-4269-4607-8DD3-D93BA14CE88B&apn_ptnrs=BBE&apn_dtid=^OSJ000^YY^PL&apn_dbr=Launcher.exe_0_25.0.1614.68&doi=2014-11-05&trgb=IE&q={searchTerms}&psv=&pt=tb BHO: couponpeak -> {04c4d6ff-f8fd-42b5-b48f-35fc4b933822} -> C:\ProgramData\couponpeak\zkLHllg5dyPZdJ.x64.dll No File Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKU\S-1-5-21-3448794057-2279744148-3698898670-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Toolbar: HKU\S-1-5-21-3448794057-2279744148-3698898670-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKU\S-1-5-21-3448794057-2279744148-3698898670-1000 -> No Name - {4F524A2D-5350-4500-76A7-7A786E7484D7} - No File Task: {67734A5B-CB63-4097-A58F-54178EED332E} - System32\Tasks\{634D9B69-1634-4909-87C5-2D5E59B31A0A} => Iexplore.exe http://ui.skype.com/ui/0/5.10.0.115/pl/go/help.faq.installer?source=lightinstaller&LastError=1618 C:\Program Files\Google C:\Program Files (x86)\App Lid C:\Program Files (x86)\Google C:\Program Files (x86)\Mozilla Firefox C:\Program Files (x86)\Opera C:\ProgramData\ee67026fc86de1d C:\ProgramData\APN C:\ProgramData\boost_interprocess C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AppsHat C:\ProgramData\Norton C:\ProgramData\Partner C:\ProgramData\Symantec C:\Users\Gizela\AppData\Local\Google C:\Users\Gizela\AppData\Local\Opera Software C:\Users\Gizela\AppData\Roaming\0I0M0D1F2W1G1I1F1T1Q1P1C C:\Users\Gizela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PriceFountain C:\Users\Gizela\AppData\Roaming\Mozilla C:\Users\Gizela\AppData\Roaming\Opera Software C:\Users\Gizela\AppData\Roaming\PriceFountain C:\Users\Gizela\AppData\Roaming\Systweak C:\Users\Gizela\Downloads\*(*)-dp*.exe C:\Users\Gizela\Downloads\*.opdownload C:\Users\Gizela\Downloads\chromeinstall*.exe C:\Users\Gizela\Downloads\farming_simulator_*.exe C:\Users\Gizela\Downloads\minecraft*.exe C:\Users\Gizela\Downloads\Niepotwierdzony*.crdownload C:\Users\Gizela\Downloads\pobierz_*.exe C:\Users\Gizela\Downloads\SpyHunter 4.17.6.4336 + SCREEN.rar C:\Users\Gizela\Downloads\SpyHunter 4.17.6.4336 + SCREEN C:\Windows\AF54923662584AC6A0435B5B89C6EB61.TMP C:\Windows\system32\Drivers\kgpcpy.cfg C:\Windows\SysWOW64\Drivers\kgpfr2.cfg Reg: reg delete HKCU\Software\Google /f Reg: reg delete HKCU\Software\Mozilla /f Reg: reg delete HKCU\Software\MozillaPlugins /f Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Google /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\mozilla.org /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f Reg: reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {00C9AC02-9004-431F-A2EB-9E912595B2CA} /f Reg: reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {00C9AC02-9004-431F-A2EB-9E912595B2CA} /f CMD: dir /a "C:\Program Files" CMD: dir /a "C:\Program Files (x86)" CMD: dir /a C:\ProgramData CMD: dir /a C:\Users\Gizela\AppData\Local CMD: dir /a C:\Users\Gizela\AppData\LocalLow CMD: dir /a C:\Users\Gizela\AppData\Roaming EmptyTemp: ***************** Processes closed successfully. "HKU\S-1-5-21-3448794057-2279744148-3698898670-1000\Software\Classes\exefile" => Key deleted successfully. "HKU\S-1-5-21-3448794057-2279744148-3698898670-1000\Software\Classes\.exe" => Key deleted successfully. "HKU\S-1-5-21-3448794057-2279744148-3698898670-1000\Software\Classes\exefile" => Key not found. C:\Windows\system32\GroupPolicy\Machine => Moved successfully. C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully. "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully. "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully. "HKU\S-1-5-21-3448794057-2279744148-3698898670-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully. "HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found. "HKU\S-1-5-21-3448794057-2279744148-3698898670-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{724893F4-3AC6-4B99-8599-45F2BDBB2D42}" => Key deleted successfully. "HKCR\CLSID\{724893F4-3AC6-4B99-8599-45F2BDBB2D42}" => Key not found. "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{04c4d6ff-f8fd-42b5-b48f-35fc4b933822}" => Key deleted successfully. "HKCR\CLSID\{04c4d6ff-f8fd-42b5-b48f-35fc4b933822}" => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} => value deleted successfully. "HKCR\CLSID\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}" => Key deleted successfully. HKU\S-1-5-21-3448794057-2279744148-3698898670-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value deleted successfully. "HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" => Key not found. HKU\S-1-5-21-3448794057-2279744148-3698898670-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully. "HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}" => Key not found. HKU\S-1-5-21-3448794057-2279744148-3698898670-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4F524A2D-5350-4500-76A7-7A786E7484D7} => value deleted successfully. "HKCR\CLSID\{4F524A2D-5350-4500-76A7-7A786E7484D7}" => Key not found. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{67734A5B-CB63-4097-A58F-54178EED332E}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{67734A5B-CB63-4097-A58F-54178EED332E}" => Key deleted successfully. C:\Windows\System32\Tasks\{634D9B69-1634-4909-87C5-2D5E59B31A0A} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{634D9B69-1634-4909-87C5-2D5E59B31A0A}" => Key deleted successfully. C:\Program Files\Google => Moved successfully. C:\Program Files (x86)\App Lid => Moved successfully. C:\Program Files (x86)\Google => Moved successfully. C:\Program Files (x86)\Mozilla Firefox => Moved successfully. C:\Program Files (x86)\Opera => Moved successfully. C:\ProgramData\ee67026fc86de1d => Moved successfully. C:\ProgramData\APN => Moved successfully. C:\ProgramData\boost_interprocess => Moved successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AppsHat => Moved successfully. C:\ProgramData\Norton => Moved successfully. C:\ProgramData\Partner => Moved successfully. C:\ProgramData\Symantec => Moved successfully. C:\Users\Gizela\AppData\Local\Google => Moved successfully. C:\Users\Gizela\AppData\Local\Opera Software => Moved successfully. C:\Users\Gizela\AppData\Roaming\0I0M0D1F2W1G1I1F1T1Q1P1C => Moved successfully. C:\Users\Gizela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PriceFountain => Moved successfully. C:\Users\Gizela\AppData\Roaming\Mozilla => Moved successfully. C:\Users\Gizela\AppData\Roaming\Opera Software => Moved successfully. C:\Users\Gizela\AppData\Roaming\PriceFountain => Moved successfully. C:\Users\Gizela\AppData\Roaming\Systweak => Moved successfully. C:\Users\Gizela\Downloads\*(*)-dp*.exe => Moved successfully. C:\Users\Gizela\Downloads\*.opdownload => Moved successfully. C:\Users\Gizela\Downloads\chromeinstall*.exe => Moved successfully. C:\Users\Gizela\Downloads\farming_simulator_*.exe => Moved successfully. C:\Users\Gizela\Downloads\minecraft*.exe => Moved successfully. C:\Users\Gizela\Downloads\Niepotwierdzony*.crdownload => Moved successfully. C:\Users\Gizela\Downloads\pobierz_*.exe => Moved successfully. C:\Users\Gizela\Downloads\SpyHunter 4.17.6.4336 + SCREEN.rar => Moved successfully. C:\Users\Gizela\Downloads\SpyHunter 4.17.6.4336 + SCREEN => Moved successfully. C:\Windows\AF54923662584AC6A0435B5B89C6EB61.TMP => Moved successfully. C:\Windows\system32\Drivers\kgpcpy.cfg => Moved successfully. C:\Windows\SysWOW64\Drivers\kgpfr2.cfg => Moved successfully. ========= reg delete HKCU\Software\Google /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKCU\Software\Mozilla /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKCU\Software\MozillaPlugins /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\MozillaPlugins /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\Google /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\mozilla.org /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {00C9AC02-9004-431F-A2EB-9E912595B2CA} /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {00C9AC02-9004-431F-A2EB-9E912595B2CA} /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= dir /a "C:\Program Files" ========= Wolumin w stacji C to System Numer seryjny woluminu: AE31-AC31 Katalog: C:\Program Files 2014-11-26 11:03