Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-01-2015 Ran by LAPTOP at 2015-01-12 20:27:07 Run:1 Running from C:\Users\LAPTOP\Desktop Loaded Profile: LAPTOP (Available profiles: LAPTOP) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: CreateRestorePoint: R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [473088 2015-01-11] (Fuyu LIMITED) [File not signed] HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hp&ts=1421003149&from=cor&uid=HitachiXHTS547550A9E384_J2560051F96ZWGF96ZWGX HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hp&ts=1421003149&from=cor&uid=HitachiXHTS547550A9E384_J2560051F96ZWGF96ZWGX HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1421003149&from=cor&uid=HitachiXHTS547550A9E384_J2560051F96ZWGF96ZWGX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1421003149&from=cor&uid=HitachiXHTS547550A9E384_J2560051F96ZWGF96ZWGX&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hp&ts=1421003149&from=cor&uid=HitachiXHTS547550A9E384_J2560051F96ZWGF96ZWGX HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hp&ts=1421003149&from=cor&uid=HitachiXHTS547550A9E384_J2560051F96ZWGF96ZWGX HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1421003149&from=cor&uid=HitachiXHTS547550A9E384_J2560051F96ZWGF96ZWGX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1421003149&from=cor&uid=HitachiXHTS547550A9E384_J2560051F96ZWGF96ZWGX&q={searchTerms} SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1421003149&from=cor&uid=HitachiXHTS547550A9E384_J2560051F96ZWGF96ZWGX&q={searchTerms} SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1421003149&from=cor&uid=HitachiXHTS547550A9E384_J2560051F96ZWGF96ZWGX&q={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1421003149&from=cor&uid=HitachiXHTS547550A9E384_J2560051F96ZWGF96ZWGX&q={searchTerms} SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1421003149&from=cor&uid=HitachiXHTS547550A9E384_J2560051F96ZWGF96ZWGX&q={searchTerms} FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\LAPTOP\AppData\Roaming\Mozilla\Firefox\Profiles\ams11q1f.default\extensions\fftoolbar2014@etech.com FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\LAPTOP\AppData\Roaming\Mozilla\Firefox\Profiles\ams11q1f.default\extensions\faststartff@gmail.com Task: {CC659DD6-D363-4B87-BAB5-BC6AEA49ED52} - System32\Tasks\{67046EC0-43FE-4E9E-9E27-2B61E3B2F4E8} => pcalua.exe -a C:\Users\LAPTOP\AppData\Roaming\omiga-plus\UninstallManager.exe -c -ptid=cor <==== ATTENTION C:\ProgramData\APN C:\ProgramData\WindowsMangerProtect C:\Program Files (x86)\Temp C:\Users\LAPTOP\AppData\Roaming\omiga-plus EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. WindowsMangerProtect => Service deleted successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\fftoolbar2014@etech.com => value deleted successfully. HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\faststartff@gmail.com => value deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CC659DD6-D363-4B87-BAB5-BC6AEA49ED52}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CC659DD6-D363-4B87-BAB5-BC6AEA49ED52}" => Key deleted successfully. C:\Windows\System32\Tasks\{67046EC0-43FE-4E9E-9E27-2B61E3B2F4E8} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{67046EC0-43FE-4E9E-9E27-2B61E3B2F4E8}" => Key deleted successfully. C:\ProgramData\APN => Moved successfully. C:\ProgramData\WindowsMangerProtect => Moved successfully. C:\Program Files (x86)\Temp => Moved successfully. C:\Users\LAPTOP\AppData\Roaming\omiga-plus => Moved successfully. EmptyTemp: => Removed 864.9 MB temporary data. The system needed a reboot. ==== End of Fixlog 20:28:18 ====