Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-02-2015 Ran by Masa at 2015-02-14 21:25:14 Run:1 Running from C:\Users\Masa\Desktop Loaded Profiles: Masa & UpdatusUser (Available profiles: Masa & UpdatusUser) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: CreateRestorePoint: R1 {089299d4-0680-4375-a6a9-d9a7c9109a71}Gw64; C:\Windows\System32\drivers\{089299d4-0680-4375-a6a9-d9a7c9109a71}Gw64.sys [48792 2015-02-06] (StdLib) R1 {dcd044e6-adb7-46c3-8ece-3d3a0a33bf3a}Gw64; C:\Windows\System32\drivers\{dcd044e6-adb7-46c3-8ece-3d3a0a33bf3a}Gw64.sys [48792 2015-02-12] (StdLib) R1 {e65048d8-bd76-44ed-ac28-c25d339ab590}Gw64; C:\Windows\System32\drivers\{e65048d8-bd76-44ed-ac28-c25d339ab590}Gw64.sys [48792 2015-02-09] (StdLib) R1 {feff35ba-2139-454f-bd8e-bc1ab8b3774d}Gw64; C:\Windows\System32\drivers\{feff35ba-2139-454f-bd8e-bc1ab8b3774d}Gw64.sys [48792 2015-02-08] (StdLib) R2 1991b13a; c:\Program Files (x86)\SystemBoost\SystemBoost.dll [1584640 2015-02-14] () [File not signed] S2 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [3505936 2015-01-28] () [File not signed] S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2015-02-03] (globalUpdate) [File not signed] S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2015-02-03] (globalUpdate) [File not signed] S2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [715656 2014-12-25] () [File not signed] S4 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [485888 2014-12-25] () [File not signed] S1 wpnfd_1_10_0_6; system32\drivers\wpnfd_1_10_0_6.sys [X] Task: {0D9868FB-3625-4AEC-BAD0-C68A6296D399} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: {1F4DCA95-636F-4382-B80E-7D4C4583A5BE} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2015-02-03] (globalUpdate) <==== ATTENTION Task: {4B297BBA-2CDB-4F14-94ED-D8A4A7E0BB30} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: {549F9B7E-C92C-48E7-9712-42CC1FC22F44} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: {6AE89E44-81A8-4080-9849-0C3DB94CA097} - System32\Tasks\Taplika => C:\Users\Masa\AppData\Roaming\Taplika\UpdateProc\UpdateTask.exe [2015-02-06] () <==== ATTENTION Task: {D9895477-3D4E-4B56-B7A7-AD44A9A4D4AC} - System32\Tasks\globalUpdateUpdateTaskMachineCore => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2015-02-03] (globalUpdate) <==== ATTENTION Task: {E2FD4A0B-622C-496C-B515-679A40710B7F} - System32\Tasks\avaxvavya => C:\Users\Masa\AppData\Local\avaxvavya\avaxvavya.exe [2015-01-28] () Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION Task: C:\Windows\Tasks\Taplika.job => C:\Users\Masa\AppData\Roaming\Taplika\UPDATE~1\UPDATE~1.EXE <==== ATTENTION AppInit_DLLs-x32: _c:\progra~2\search~1\search~1\bin\vc32lo~1.dll => c:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll [219408 2015-01-28] () Startup: C:\Users\Masa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TornTvDownloader.lnk HKLM\...\Run: [3D BubbleSound] => "C:\Program Files\BubbleSound\3D BubbleSound.exe" HKLM-x32\...\Run: [gmsd_de_174] => [X] HKLM-x32\...\Run: [gmsd_de_187] => [X] HKLM-x32\...\Run: [gmsd_de_192] => [X] HKLM-x32\...\RunOnce: [Taplika] => C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\Masa\AppData\Roaming\Taplika\UpdateProc\bkup.dat" HKU\S-1-5-21-4164922102-3460450381-1936108056-1000\...\Run: [TornTv Downloader] => C:\Users\Masa\AppData\Roaming\TornTV.com\Torntv Downloader.exe /c=startup HKU\S-1-5-21-4164922102-3460450381-1936108056-1000\...\RunOnce: [Taplika] => C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\Masa\AppData\Roaming\Taplika\UpdateProc\bkup.dat" GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://isearch.omiga-plus.com/?type=sc&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX ShortcutWithArgument: C:\Users\Masa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://isearch.omiga-plus.com/?type=sc&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX ShortcutWithArgument: C:\Users\Masa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://isearch.omiga-plus.com/?type=sc&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX ShortcutWithArgument: C:\Users\Masa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://isearch.omiga-plus.com/?type=sc&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hp&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hp&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hp&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hp&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX&q={searchTerms} HKU\S-1-5-21-4164922102-3460450381-1936108056-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://taplika.com/?f=1&a=tpl_tuto2_15_06&cd=2XzuyEtN2Y1L1Qzuzz0Czzzy0AyDtDtCzyyD0EyBzy0B0FyBtN0D0Tzu0StCtCtAtBtN1L2XzutAtFyBtFtBtFtDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StDyB0CtC0C0FtA0FtGtCyByEtAtG0DtD0CtCtGtBtC0CtCtGyEzz0B0CtA0EyDyEtAyE0F0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDyDtB0B0CtDtB0EtG0BzytCzztGyEyCtDyDtG0AyCtDtBtGyE0Bzzzy0CyD0AyDzytC0FyB2Q&cr=1211795611&ir= HKU\S-1-5-21-4164922102-3460450381-1936108056-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hp&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX&q={searchTerms} SearchScopes: HKLM -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://taplika.com/results.php?f=4&q={searchTerms}&a=tpl_tuto2_15_06&cd=2XzuyEtN2Y1L1Qzuzz0Czzzy0AyDtDtCzyyD0EyBzy0B0FyBtN0D0Tzu0StCtCtAtBtN1L2XzutAtFyBtFtBtFtDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StDyB0CtC0C0FtA0FtGtCyByEtAtG0DtD0CtCtGtBtC0CtCtGyEzz0B0CtA0EyDyEtAyE0F0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDyDtB0B0CtDtB0EtG0BzytCzztGyEyCtDyDtG0AyCtDtBtGyE0Bzzzy0CyD0AyDzytC0FyB2Q&cr=1211795611&ir= SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX&q={searchTerms} SearchScopes: HKLM -> {589B893E-773C-4941-88C2-0DCC718E621C} URL = SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX&q={searchTerms} SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX&q={searchTerms} SearchScopes: HKU\S-1-5-21-4164922102-3460450381-1936108056-1000 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://taplika.com/results.php?f=4&q={searchTerms}&a=tpl_tuto2_15_06&cd=2XzuyEtN2Y1L1Qzuzz0Czzzy0AyDtDtCzyyD0EyBzy0B0FyBtN0D0Tzu0StCtCtAtBtN1L2XzutAtFyBtFtBtFtDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StDyB0CtC0C0FtA0FtGtCyByEtAtG0DtD0CtCtGtBtC0CtCtGyEzz0B0CtA0EyDyEtAyE0F0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDyDtB0B0CtDtB0EtG0BzytCzztGyEyCtDyDtG0AyCtDtBtGyE0Bzzzy0CyD0AyDzytC0FyB2Q&cr=1211795611&ir= SearchScopes: HKU\S-1-5-21-4164922102-3460450381-1936108056-1000 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://taplika.com/results.php?f=4&q={searchTerms}&a=tpl_tuto2_15_06&cd=2XzuyEtN2Y1L1Qzuzz0Czzzy0AyDtDtCzyyD0EyBzy0B0FyBtN0D0Tzu0StCtCtAtBtN1L2XzutAtFyBtFtBtFtDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StDyB0CtC0C0FtA0FtGtCyByEtAtG0DtD0CtCtGtBtC0CtCtGyEzz0B0CtA0EyDyEtAyE0F0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDyDtB0B0CtDtB0EtG0BzytCzztGyEyCtDyDtG0AyCtDtBtGyE0Bzzzy0CyD0AyDzytC0FyB2Q&cr=1211795611&ir= SearchScopes: HKU\S-1-5-21-4164922102-3460450381-1936108056-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1419531078&from=ild&uid=HitachiXHTS727575A9E364_J3740084HB11YEHB11YEX&q={searchTerms} SearchScopes: HKU\S-1-5-21-4164922102-3460450381-1936108056-1000 -> {589B893E-773C-4941-88C2-0DCC718E621C} URL = http://www.trovi.com/Results.aspx?gd=&ctid=CT3330130&octid=EB_ORIGINAL_CTID&ISID=M00C716EB-9838-4600-A7CF-2C526BD15C9E&SearchSource=58&CUI=&UM=8&UP=SPB28B4711-4CBB-4B83-98B5-99FF36603867&q={searchTerms}&SSPV= BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited) StartMenuInternet: IEXPLORE.EXE - iexplore.exe FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate) FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\omiga-plus.xml FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Masa\AppData\Roaming\Mozilla\Firefox\Profiles\cyk539n4.default\extensions\faststartff@gmail.com StartMenuInternet: FIREFOX.EXE - firefox.exe C:\AI_RecycleBin C:\Program Files (x86)\Adblock for Gmail C:\Program Files (x86)\ApptoUa C:\Program Files (x86)\FineeDealSaOeft C:\Program Files (x86)\globalUpdate C:\Program Files (x86)\MyPC Backup C:\Program Files (x86)\predm C:\Program Files (x86)\SearchProtect C:\Program Files (x86)\SooftCooup C:\Program Files (x86)\SupTab C:\Program Files (x86)\SystemBoost C:\Program Files (x86)\WebbsAveER C:\ProgramData\28c34e92bb2ca7ad C:\ProgramData\2937277774088153005 C:\ProgramData\ApptoUa C:\ProgramData\CouponFactory C:\ProgramData\e8df2bc8000026f4 C:\ProgramData\IePluginServices C:\ProgramData\SharkManCoupon C:\ProgramData\Uniblue C:\ProgramData\WebbsAveER C:\ProgramData\WindowsMangerProtect C:\Users\Masa\AppData\Local\nsa6E49.tmp C:\Users\Masa\AppData\Local\nsiDDBD.tmp C:\Users\Masa\AppData\Local\proxy.log C:\Users\Masa\AppData\Local\avaxvavya C:\Users\Masa\AppData\Local\ContextTrue C:\Users\Masa\AppData\Local\Gameo C:\Users\Masa\AppData\Local\GGEmpire C:\Users\Masa\AppData\Local\Google C:\Users\Masa\AppData\Local\Pirates C:\Users\Masa\AppData\Local\SearchProtect C:\Users\Masa\AppData\Local\Sparta C:\Users\Masa\AppData\Local\StormFall C:\Users\Masa\AppData\Roaming\HBTTGY.exe C:\Users\Masa\AppData\Roaming\OKXJLUU.exe C:\Users\Masa\AppData\Roaming\AnyProtectEx C:\Users\Masa\AppData\Roaming\BRT C:\Users\Masa\AppData\Roaming\EurekaLog C:\Users\Masa\AppData\Roaming\GoldenGate C:\Users\Masa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Play Games Online.url C:\Users\Masa\AppData\Roaming\Pirates946 C:\Users\Masa\AppData\Roaming\Pro PC Cleaner C:\Users\Masa\AppData\Roaming\StormFall C:\Users\Masa\AppData\Roaming\Taplika C:\Users\Masa\AppData\Roaming\TornTV.com C:\Users\Masa\Downloads\Installation*.exe C:\Users\UpdatusUser\Desktop\MagnoPlayer.lnk C:\Windows\patsearch.bin C:\Windows\system32\OptimizerMonitorOff.ini C:\Windows\System32\drivers\{089299d4-0680-4375-a6a9-d9a7c9109a71}Gw64.sys C:\Windows\System32\drivers\{dcd044e6-adb7-46c3-8ece-3d3a0a33bf3a}Gw64.sys C:\Windows\System32\drivers\{e65048d8-bd76-44ed-ac28-c25d339ab590}Gw64.sys C:\Windows\System32\drivers\{feff35ba-2139-454f-bd8e-bc1ab8b3774d}Gw64.sys C:\Windows\system32\Drivers\Msft_Kernel_webinstrNHKT_01009.Wdf C:\Windows\SysWOW64\OptimizerMonitor.ini C:\Windows\SysWOW64\OptimizerMonitorOff.ini Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f Reg: reg delete HKCU\Software\Google /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Google /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{1991b13a} /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{37476589-E48E-439E-A706-56189E2ED4C4}_is1) /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect /f CMD: dir /a "C:\Program Files" CMD: dir /a "C:\Program Files (x86)" CMD: dir /a "C:\Program Files\Common Files" CMD: dir /a "C:\Program Files (x86)\Common Files" CMD: dir /a C:\ProgramData CMD: dir /a C:\Users\Masa\AppData\Local CMD: dir /a C:\Users\Masa\AppData\LocalLow CMD: dir /a C:\Users\Masa\AppData\Roaming EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. {089299d4-0680-4375-a6a9-d9a7c9109a71}Gw64 => Service stopped successfully. {089299d4-0680-4375-a6a9-d9a7c9109a71}Gw64 => Service deleted successfully. {dcd044e6-adb7-46c3-8ece-3d3a0a33bf3a}Gw64 => Service stopped successfully. {dcd044e6-adb7-46c3-8ece-3d3a0a33bf3a}Gw64 => Service deleted successfully. {e65048d8-bd76-44ed-ac28-c25d339ab590}Gw64 => Service stopped successfully. {e65048d8-bd76-44ed-ac28-c25d339ab590}Gw64 => Service deleted successfully. {feff35ba-2139-454f-bd8e-bc1ab8b3774d}Gw64 => Service stopped successfully. {feff35ba-2139-454f-bd8e-bc1ab8b3774d}Gw64 => Service deleted successfully. 1991b13a => Service not found. CltMngSvc => Service deleted successfully. globalUpdate => Service deleted successfully. globalUpdatem => Service deleted successfully. IePluginServices => Service deleted successfully. WindowsMangerProtect => Service deleted successfully. wpnfd_1_10_0_6 => Service deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0D9868FB-3625-4AEC-BAD0-C68A6296D399}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0D9868FB-3625-4AEC-BAD0-C68A6296D399}" => Key deleted successfully. C:\Windows\System32\Tasks\APSnotifierPP3 => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP3" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1F4DCA95-636F-4382-B80E-7D4C4583A5BE}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1F4DCA95-636F-4382-B80E-7D4C4583A5BE}" => Key deleted successfully. C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\globalUpdateUpdateTaskMachineUA" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4B297BBA-2CDB-4F14-94ED-D8A4A7E0BB30}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4B297BBA-2CDB-4F14-94ED-D8A4A7E0BB30}" => Key deleted successfully. C:\Windows\System32\Tasks\APSnotifierPP2 => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP2" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{549F9B7E-C92C-48E7-9712-42CC1FC22F44}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{549F9B7E-C92C-48E7-9712-42CC1FC22F44}" => Key deleted successfully. C:\Windows\System32\Tasks\APSnotifierPP1 => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP1" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6AE89E44-81A8-4080-9849-0C3DB94CA097}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6AE89E44-81A8-4080-9849-0C3DB94CA097}" => Key deleted successfully. C:\Windows\System32\Tasks\Taplika => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Taplika" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D9895477-3D4E-4B56-B7A7-AD44A9A4D4AC}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D9895477-3D4E-4B56-B7A7-AD44A9A4D4AC}" => Key deleted successfully. C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\globalUpdateUpdateTaskMachineCore" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E2FD4A0B-622C-496C-B515-679A40710B7F}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E2FD4A0B-622C-496C-B515-679A40710B7F}" => Key deleted successfully. C:\Windows\System32\Tasks\avaxvavya => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\avaxvavya" => Key deleted successfully. C:\Windows\Tasks\APSnotifierPP1.job => Moved successfully. C:\Windows\Tasks\APSnotifierPP2.job => Moved successfully. C:\Windows\Tasks\APSnotifierPP3.job => Moved successfully. C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => Moved successfully. C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => Moved successfully. C:\Windows\Tasks\Taplika.job => Moved successfully. "_c:\progra~2\search~1\search~1\bin\vc32lo~1.dll" => Value Data removed successfully. C:\Users\Masa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TornTvDownloader.lnk => Moved successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\3D BubbleSound => value deleted successfully. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\gmsd_de_174 => value deleted successfully. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\gmsd_de_187 => value deleted successfully. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\gmsd_de_192 => value deleted successfully. HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\Taplika => value deleted successfully. HKU\S-1-5-21-4164922102-3460450381-1936108056-1000\Software\Microsoft\Windows\CurrentVersion\Run\\TornTv Downloader => value deleted successfully. HKU\S-1-5-21-4164922102-3460450381-1936108056-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Taplika => value deleted successfully. C:\Windows\system32\GroupPolicy\Machine => Moved successfully. C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully. "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk => Shortcut argument was removed successfully. C:\Users\Masa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk => Shortcut argument was removed successfully. C:\Users\Masa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk => Shortcut argument was restored successfully. C:\Users\Masa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk => Shortcut argument was removed successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKU\S-1-5-21-4164922102-3460450381-1936108056-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKU\S-1-5-21-4164922102-3460450381-1936108056-1000\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}" => Key deleted successfully. HKCR\CLSID\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} => Key not found. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{589B893E-773C-4941-88C2-0DCC718E621C}" => Key deleted successfully. HKCR\CLSID\{589B893E-773C-4941-88C2-0DCC718E621C} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKU\S-1-5-21-4164922102-3460450381-1936108056-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully. "HKU\S-1-5-21-4164922102-3460450381-1936108056-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}" => Key deleted successfully. HKCR\CLSID\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} => Key not found. "HKU\S-1-5-21-4164922102-3460450381-1936108056-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. "HKU\S-1-5-21-4164922102-3460450381-1936108056-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{589B893E-773C-4941-88C2-0DCC718E621C}" => Key deleted successfully. HKCR\CLSID\{589B893E-773C-4941-88C2-0DCC718E621C} => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" => Key deleted successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. "HKLM\Software\Wow6432Node\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10" => Key deleted successfully. C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll => Moved successfully. "HKLM\Software\Wow6432Node\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4" => Key deleted successfully. C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll not found. C:\Program Files (x86)\mozilla firefox\browser\searchplugins\omiga-plus.xml => Moved successfully. HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\faststartff@gmail.com => value deleted successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\\Default => Value was restored successfully. C:\AI_RecycleBin => Moved successfully. C:\Program Files (x86)\Adblock for Gmail => Moved successfully. C:\Program Files (x86)\ApptoUa => Moved successfully. C:\Program Files (x86)\FineeDealSaOeft => Moved successfully. C:\Program Files (x86)\globalUpdate => Moved successfully. C:\Program Files (x86)\MyPC Backup => Moved successfully. C:\Program Files (x86)\predm => Moved successfully. C:\Program Files (x86)\SearchProtect => Moved successfully. C:\Program Files (x86)\SooftCooup => Moved successfully. C:\Program Files (x86)\SupTab => Moved successfully. "C:\Program Files (x86)\SystemBoost" => File/Directory not found. C:\Program Files (x86)\WebbsAveER => Moved successfully. C:\ProgramData\28c34e92bb2ca7ad => Moved successfully. C:\ProgramData\2937277774088153005 => Moved successfully. C:\ProgramData\ApptoUa => Moved successfully. C:\ProgramData\CouponFactory => Moved successfully. C:\ProgramData\e8df2bc8000026f4 => Moved successfully. C:\ProgramData\IePluginServices => Moved successfully. C:\ProgramData\SharkManCoupon => Moved successfully. C:\ProgramData\Uniblue => Moved successfully. C:\ProgramData\WebbsAveER => Moved successfully. C:\ProgramData\WindowsMangerProtect => Moved successfully. C:\Users\Masa\AppData\Local\nsa6E49.tmp => Moved successfully. C:\Users\Masa\AppData\Local\nsiDDBD.tmp => Moved successfully. C:\Users\Masa\AppData\Local\proxy.log => Moved successfully. C:\Users\Masa\AppData\Local\avaxvavya => Moved successfully. C:\Users\Masa\AppData\Local\ContextTrue => Moved successfully. C:\Users\Masa\AppData\Local\Gameo => Moved successfully. C:\Users\Masa\AppData\Local\GGEmpire => Moved successfully. C:\Users\Masa\AppData\Local\Google => Moved successfully. C:\Users\Masa\AppData\Local\Pirates => Moved successfully. C:\Users\Masa\AppData\Local\SearchProtect => Moved successfully. C:\Users\Masa\AppData\Local\Sparta => Moved successfully. C:\Users\Masa\AppData\Local\StormFall => Moved successfully. C:\Users\Masa\AppData\Roaming\HBTTGY.exe => Moved successfully. C:\Users\Masa\AppData\Roaming\OKXJLUU.exe => Moved successfully. C:\Users\Masa\AppData\Roaming\AnyProtectEx => Moved successfully. C:\Users\Masa\AppData\Roaming\BRT => Moved successfully. C:\Users\Masa\AppData\Roaming\EurekaLog => Moved successfully. C:\Users\Masa\AppData\Roaming\GoldenGate => Moved successfully. C:\Users\Masa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Play Games Online.url => Moved successfully. C:\Users\Masa\AppData\Roaming\Pirates946 => Moved successfully. C:\Users\Masa\AppData\Roaming\Pro PC Cleaner => Moved successfully. C:\Users\Masa\AppData\Roaming\StormFall => Moved successfully. C:\Users\Masa\AppData\Roaming\Taplika => Moved successfully. "C:\Users\Masa\AppData\Roaming\TornTV.com" => File/Directory not found. C:\Users\Masa\Downloads\Installation*.exe => Moved successfully. C:\Users\UpdatusUser\Desktop\MagnoPlayer.lnk => Moved successfully. C:\Windows\patsearch.bin => Moved successfully. C:\Windows\system32\OptimizerMonitorOff.ini => Moved successfully. C:\Windows\System32\drivers\{089299d4-0680-4375-a6a9-d9a7c9109a71}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{dcd044e6-adb7-46c3-8ece-3d3a0a33bf3a}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{e65048d8-bd76-44ed-ac28-c25d339ab590}Gw64.sys => Moved successfully. C:\Windows\System32\drivers\{feff35ba-2139-454f-bd8e-bc1ab8b3774d}Gw64.sys => Moved successfully. C:\Windows\system32\Drivers\Msft_Kernel_webinstrNHKT_01009.Wdf => Moved successfully. C:\Windows\SysWOW64\OptimizerMonitor.ini => Moved successfully. C:\Windows\SysWOW64\OptimizerMonitorOff.ini => Moved successfully. ========= reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKCU\Software\Google /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\Google /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{1991b13a} /f ========= Bť¤D: System nie znalazˆ w rejestrze okre˜lonego klucza albo warto˜ci. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{37476589-E48E-439E-A706-56189E2ED4C4}_is1) /f ========= Bť¤D: System nie znalazˆ w rejestrze okre˜lonego klucza albo warto˜ci. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= dir /a "C:\Program Files" ========= Wolumin w stacji C nie ma etykiety. Numer seryjny woluminu: 50EE-9BF7 Katalog: C:\Program Files 2015-02-14 20:00