Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-02-2015 01 Ran by RHinplus at 2015-02-21 15:01:49 Run:2 Running from C:\Users\RHinplus\Downloads Loaded Profiles: RHinplus & (Available profiles: RHinplus) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: CreateRestorePoint: Task: {5457EA6E-7E01-4FB3-9178-70FCFC2DEB4E} - System32\Tasks\ZRZYR => C:\Users\RHinplus\AppData\Roaming\ZRZYR.exe <==== ATTENTION Task: {5FAE7704-53AA-41DE-B1AC-88E637A17980} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-173311020-2444926906-3683853307-1001 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe Task: {BBF45837-F7B9-4660-B482-243435B0EF69} - System32\Tasks\UNELEVATE_15164 => C:\Program Files (x86)\ShopperPro\JSDriver\1.37.0.1413\jsdrv.exe <==== ATTENTION Task: {CBF23037-DB97-44E0-AB53-42188BEE804E} - System32\Tasks\AB => C:\Users\RHinplus\AppData\Roaming\AB.exe <==== ATTENTION Task: C:\windows\Tasks\AB.job => C:\Users\RHinplus\AppData\Roaming\AB.exe <==== ATTENTION Task: C:\windows\Tasks\ZRZYR.job => C:\Users\RHinplus\AppData\Roaming\ZRZYR.exe <==== ATTENTION HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""="" Winlogon\Notify\igfxcui: igfxdev.dll [X] ShellIconOverlayIdentifiers-x32: [IB24SynchronizationPending] -> {08ad9864-e486-4cdb-8781-d507026cf5d6} => No File ShellIconOverlayIdentifiers-x32: [IB24Synchronized] -> {08ad9864-e486-4cdb-8781-d507026cf5d7} => No File HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp120141207 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp120141207 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com HKU\S-1-5-21-173311020-2444926906-3683853307-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search.ask.com/?tpid=SGT-SP&o=APN11004&pf=V7&trgb=IE&p2=^B3Q^aaa155^YY^PL&gct=hp&apn_ptnrs=^B3Q&apn_dtid=^aaa155^YY^PL&apn_dbr=cr_39.0.2171.71&apn_uid=22356410-F6EA-4B6C-8637-A74A9BDEB0A3&itbv=12.21.0.3795&doi=2014-12-07&psv=&pt=tb SearchScopes: HKU\S-1-5-21-173311020-2444926906-3683853307-1001 -> {1A95DC8F-4A6D-4938-B715-50B59B516306} URL = SearchScopes: HKU\S-1-5-21-173311020-2444926906-3683853307-1001 -> {6F87B2D8-0510-4843-87BE-A14959A33E93} URL = http://www.search.ask.com/web?tpid=SGT-SP&o=APN11004&pf=V7&p2=^B3Q^aaa155^YY^PL&gct=&itbv=12.21.0.3795&apn_uid=22356410-F6EA-4B6C-8637-A74A9BDEB0A3&apn_ptnrs=^B3Q&apn_dtid=^aaa155^YY^PL&apn_dbr=cr_39.0.2171.71&doi=2014-12-07&trgb=IE&q={searchTerms}&psv=&pt=tb StartMenuInternet: IEXPLORE.EXE - iexplore.exe CHR HomePage: Default -> CHR StartupUrls: Default -> "hxxp://google.com/", "hxxp://isearch.omiga-plus.com/?type=hp&ts=1416764338&from=smt&uid=LITEONITXLMT-256L9M-11XMSATAX256GB_TW0N42H7550854790144" CHR HKU\S-1-5-21-173311020-2444926906-3683853307-1001\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - No Path C:\Program Files (x86)\AskPartnerNetwork C:\ProgramData\*.log C:\ProgramData\AskPartnerNetwork C:\ProgramData\Temp C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator C:\Users\RHinplus\AppData\Local\AskPartnerNetwork C:\Users\RHinplus\AppData\Roaming\AB C:\Users\RHinplus\AppData\Roaming\ZRZYR C:\Users\RHinplus\AppData\Roaming\How Inc C:\Users\RHinplus\AppData\Roaming\Opera Software C:\Users\RHinplus\Downloads\Niepotwierdzony*.crdownload C:\Users\RHinplus\Downloads\FreeYouTubeDownloaderOC.exe C:\Users\RHinplus\Downloads\FYTDSetup.exe Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32 /v ApnTBMon /f EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5457EA6E-7E01-4FB3-9178-70FCFC2DEB4E} => Key not found. C:\Windows\System32\Tasks\ZRZYR not found. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ZRZYR => Key not found. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5FAE7704-53AA-41DE-B1AC-88E637A17980}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5FAE7704-53AA-41DE-B1AC-88E637A17980}" => Key deleted successfully. C:\Windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-173311020-2444926906-3683853307-1001 => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft OneDrive Auto Update Task-S-1-5-21-173311020-2444926906-3683853307-1001" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BBF45837-F7B9-4660-B482-243435B0EF69}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BBF45837-F7B9-4660-B482-243435B0EF69}" => Key deleted successfully. C:\Windows\System32\Tasks\UNELEVATE_15164 => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\UNELEVATE_15164" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{CBF23037-DB97-44E0-AB53-42188BEE804E}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CBF23037-DB97-44E0-AB53-42188BEE804E}" => Key deleted successfully. C:\Windows\System32\Tasks\AB => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AB" => Key deleted successfully. C:\windows\Tasks\AB.job => Moved successfully. C:\windows\Tasks\ZRZYR.job => Moved successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc" => Key deleted successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc" => Key deleted successfully. "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui" => Key deleted successfully. "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\IB24SynchronizationPending" => Key deleted successfully. HKCR\Wow6432Node\CLSID\{08ad9864-e486-4cdb-8781-d507026cf5d6} => Key not found. "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\IB24Synchronized" => Key deleted successfully. HKCR\Wow6432Node\CLSID\{08ad9864-e486-4cdb-8781-d507026cf5d7} => Key not found. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKU\S-1-5-21-173311020-2444926906-3683853307-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. "HKU\S-1-5-21-173311020-2444926906-3683853307-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1A95DC8F-4A6D-4938-B715-50B59B516306}" => Key deleted successfully. HKCR\CLSID\{1A95DC8F-4A6D-4938-B715-50B59B516306} => Key not found. HKU\S-1-5-21-173311020-2444926906-3683853307-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6F87B2D8-0510-4843-87BE-A14959A33E93} => Key not found. HKCR\CLSID\{6F87B2D8-0510-4843-87BE-A14959A33E93} => Key not found. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. Chrome HomePage deleted successfully. Chrome StartupUrls deleted successfully. "HKU\S-1-5-21-173311020-2444926906-3683853307-1001\SOFTWARE\Google\Chrome\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh" => Key deleted successfully. "C:\Program Files (x86)\AskPartnerNetwork" => File/Directory not found. C:\ProgramData\*.log => Moved successfully. "C:\ProgramData\AskPartnerNetwork" => File/Directory not found. C:\ProgramData\Temp => Moved successfully. "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator" => File/Directory not found. "C:\Users\RHinplus\AppData\Local\AskPartnerNetwork" => File/Directory not found. C:\Users\RHinplus\AppData\Roaming\AB => Moved successfully. C:\Users\RHinplus\AppData\Roaming\ZRZYR => Moved successfully. C:\Users\RHinplus\AppData\Roaming\How Inc => Moved successfully. C:\Users\RHinplus\AppData\Roaming\Opera Software => Moved successfully. C:\Users\RHinplus\Downloads\Niepotwierdzony*.crdownload => Moved successfully. C:\Users\RHinplus\Downloads\FreeYouTubeDownloaderOC.exe => Moved successfully. C:\Users\RHinplus\Downloads\FYTDSetup.exe => Moved successfully. ========= reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32 /v ApnTBMon /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= EmptyTemp: => Removed 4 GB temporary data. The system needed a reboot. ==== End of Fixlog 15:02:29 ====