Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-11-2014 01 Ran by Ola at 2014-11-30 10:05:50 Run:1 Running from C:\Users\Ola\Downloads Loaded Profile: Ola (Available profiles: Ola) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: HKU\S-1-5-21-1017097351-795278975-3992398382-1001\...\Policies\Explorer: [] HKU\S-1-5-21-1017097351-795278975-3992398382-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-1017097351-795278975-3992398382-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://mysearch.avg.com?cid={207CE016-4FF6-42ED-B4DB-8028A302211D}&mid=67ccd6ed490b47d2b2af6d3e7138c4b3-f0a238254cd66f9dfe39aebed6613ff935d9af74&lang=pl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-11-06 10:34:07&v=4.0.0.19&pid=wtu&sg=&sap=hp HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-1017097351-795278975-3992398382-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKU\S-1-5-21-1017097351-795278975-3992398382-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={207CE016-4FF6-42ED-B4DB-8028A302211D}&mid=67ccd6ed490b47d2b2af6d3e7138c4b3-f0a238254cd66f9dfe39aebed6613ff935d9af74&lang=pl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-11-06 10:34:07&v=4.0.0.19&pid=wtu&sg=&sap=dsp&q={searchTerms} BHO-x32: No Name -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> No File U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X] Task: {66A48566-0D38-4B21-B178-7B08925378F3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Ghost Resign Task => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\HPResignFileLoader.exe Task: {9B522B2D-D17B-4CF1-99C4-01DDDBDDBA99} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe Task: {C982744F-5FE2-4282-B99F-11B83DE62B48} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe C:\ProgramData\AVG Security Toolbar C:\Users\Default\AppData\Roaming\TuneUp Software C:\Users\Ola\AppData\Roaming\TuneUp Software Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main" /f Reg: reg delete "HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer" /f Reg: reg delete "HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer" /f Reg: reg delete "HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer" /f Reg: reg delete "HKU\S-1-5-21-1017097351-795278975-3992398382-1001\Software\Microsoft\Windows\CurrentVersion\policies\Explorer" /v NoDrives /f EmptyTemp: ***************** Processes closed successfully. HKU\S-1-5-21-1017097351-795278975-3992398382-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\ => value deleted successfully. HKU\S-1-5-21-1017097351-795278975-3992398382-1001\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKU\S-1-5-21-1017097351-795278975-3992398382-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully. "HKU\S-1-5-21-1017097351-795278975-3992398382-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. "HKU\S-1-5-21-1017097351-795278975-3992398382-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}" => Key deleted successfully. "HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}" => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}" => Key not found. AppMgmt => Service deleted successfully. catchme => Service deleted successfully. MBAMSwissArmy => Service deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{66A48566-0D38-4B21-B178-7B08925378F3}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{66A48566-0D38-4B21-B178-7B08925378F3}" => Key deleted successfully. C:\Windows\System32\Tasks\Hewlett-Packard\HP Support Assistant\Ghost Resign Task => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Hewlett-Packard\HP Support Assistant\Ghost Resign Task" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9B522B2D-D17B-4CF1-99C4-01DDDBDDBA99}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9B522B2D-D17B-4CF1-99C4-01DDDBDDBA99}" => Key deleted successfully. C:\Windows\System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Hewlett-Packard\HP Support Assistant\WarrantyChecker" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C982744F-5FE2-4282-B99F-11B83DE62B48}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C982744F-5FE2-4282-B99F-11B83DE62B48}" => Key deleted successfully. C:\Windows\System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan" => Key deleted successfully. C:\ProgramData\AVG Security Toolbar => Moved successfully. C:\Users\Default\AppData\Roaming\TuneUp Software => Moved successfully. C:\Users\Ola\AppData\Roaming\TuneUp Software => Moved successfully. ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer" /f ========= Bť¤D: System nie znalazˆ w rejestrze okre˜lonego klucza albo warto˜ci. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer" /f ========= Bť¤D: System nie znalazˆ w rejestrze okre˜lonego klucza albo warto˜ci. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer" /f ========= Bť¤D: System nie znalazˆ w rejestrze okre˜lonego klucza albo warto˜ci. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-21-1017097351-795278975-3992398382-1001\Software\Microsoft\Windows\CurrentVersion\policies\Explorer" /v NoDrives /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= EmptyTemp: => Removed 22 MB temporary data. The system needed a reboot. ==== End of Fixlog ====