Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 06-12-2014 02 Ran by marek at 2014-12-09 19:59:08 Run:2 Running from C:\Users\marek\Downloads Loaded Profile: marek (Available profiles: marek & LogMeInRemoteUser) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Lavasoft <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files\ESET <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION HKU\S-1-5-21-300751917-3985659210-3560172915-1003\...\Run: [EucubEpivn] => regsvr32.exe "C:\ProgramData\EucubEpivn\EucubEpivn.dat" HKU\S-1-5-18\...\RunOnce: [AutoLaunch] => C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe monthly Task: {8C86B6DC-108A-4FB9-9902-1DC702D854C5} - System32\Tasks\Ad-Aware Update (Weekly) => C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe S2 RoxLiveShare10; "C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe" [X] FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll No File FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gazeta.pl/0,0.html?p=133 HKU\S-1-5-21-300751917-3985659210-3560172915-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://msn.gazeta.pl/?ocid=OIE9HP HKU\S-1-5-21-300751917-3985659210-3560172915-1003\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com.pl/0SEPLPL/SAOS01?FORM=TOOLBR HKU\S-1-5-21-300751917-3985659210-3560172915-1003\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gazeta.pl/0,0.html?p=133 SearchScopes: HKU\S-1-5-21-300751917-3985659210-3560172915-1003 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = C:\Program Files\mozilla firefox\plugins C:\ProgramData\EucubEpivn C:\ProgramData\TEMP C:\ProgramData\Microsoft\Windows\Start Menu\Get Video Conferencing.lnk C:\ProgramData\Microsoft\Windows\Start Menu\McAfee Install.lnk C:\Users\marek\AppData\Roaming\Systweak C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f EmptyTemp: ***************** Processes closed successfully. HKLM => Group Policy Restriction on software restored successfully. HKLM => Group Policy Restriction on software restored successfully. HKLM => Group Policy Restriction on software restored successfully. HKU\S-1-5-21-300751917-3985659210-3560172915-1003\Software\Microsoft\Windows\CurrentVersion\Run\\EucubEpivn => value deleted successfully. HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\AutoLaunch => value deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8C86B6DC-108A-4FB9-9902-1DC702D854C5}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8C86B6DC-108A-4FB9-9902-1DC702D854C5}" => Key deleted successfully. C:\Windows\System32\Tasks\Ad-Aware Update (Weekly) => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Ad-Aware Update (Weekly)" => Key deleted successfully. RoxLiveShare10 => Service deleted successfully. "HKLM\Software\MozillaPlugins\@java.com/JavaPlugin" => Key not found. HKLM\Software\Mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b} => value deleted successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKU\S-1-5-21-300751917-3985659210-3560172915-1003\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKU\S-1-5-21-300751917-3985659210-3560172915-1003\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKU\S-1-5-21-300751917-3985659210-3560172915-1003\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. "HKU\S-1-5-21-300751917-3985659210-3560172915-1003\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => Key deleted successfully. "HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => Key not found. C:\Program Files\mozilla firefox\plugins => Moved successfully. C:\ProgramData\EucubEpivn => Moved successfully. C:\ProgramData\TEMP => Moved successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Get Video Conferencing.lnk => Moved successfully. C:\ProgramData\Microsoft\Windows\Start Menu\McAfee Install.lnk => Moved successfully. C:\Users\marek\AppData\Roaming\Systweak => Moved successfully. C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension => Moved successfully. ========= reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= EmptyTemp: => Removed 760.3 MB temporary data. The system needed a reboot. ==== End of Fixlog ====