Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 22-02-2015 Ran by komputer at 2015-02-23 16:46:52 Run:1 Running from C:\Documents and Settings\komputer\Moje dokumenty\Downloads Loaded Profiles: komputer (Available profiles: komputer) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: CreateRestorePoint: ShortcutWithArgument: C:\Documents and Settings\All Users\Menu Start\Programy\Google Chrome\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.istartsurf.com/?type=sc&ts=1424105409&from=ild&uid=ST3320613AS_9SZ5HG00XXXX9SZ5HG00 ShortcutWithArgument: C:\Documents and Settings\komputer\Menu Start\Programy\Akcesoria\NarzÄ™dzia systemowe\Internet Explorer (bez dodatków).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.istartsurf.com/?type=sc&ts=1424105409&from=ild&uid=ST3320613AS_9SZ5HG00XXXX9SZ5HG00 ShortcutWithArgument: C:\Documents and Settings\komputer\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.istartsurf.com/?type=sc&ts=1424105409&from=ild&uid=ST3320613AS_9SZ5HG00XXXX9SZ5HG00 ShortcutWithArgument: C:\Documents and Settings\komputer\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Uruchom przeglÄ…darkÄ™ Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.istartsurf.com/?type=sc&ts=1424105409&from=ild&uid=ST3320613AS_9SZ5HG00XXXX9SZ5HG00 StartMenuInternet: chrome.exe - Chrome.exe StartMenuInternet: IEXPLORE.EXE - iexplore.exe GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1424105409&from=ild&uid=ST3320613AS_9SZ5HG00XXXX9SZ5HG00&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm HKU\S-1-5-21-796845957-329068152-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 HKU\S-1-5-21-796845957-329068152-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.msn.com/?pc=AV01 HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION SearchScopes: HKLM -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKU\S-1-5-21-796845957-329068152-1801674531-1003 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File CustomCLSID: HKU\S-1-5-21-796845957-329068152-1801674531-1003_Classes\CLSID\{1FAF8C54-31AE-FA45-9103-120A098EDA98}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-796845957-329068152-1801674531-1003_Classes\CLSID\{3A3A3278-4E97-0008-4E1B-6DDDDD51BE9F}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-796845957-329068152-1801674531-1003_Classes\CLSID\{ADCC7130-C0AA-41F2-7268-D6F2DB5DEC02}\InprocServer32 -> No File Path CHR HKLM\...\Chrome\Extension: [nonnbhnjfhfcpmfdegkohnemghnglgpp] - C:\Documents and Settings\All Users\Dane aplikacji\ADDICT-THING\nonnbhnjfhfcpmfdegkohnemghnglgpp.crx [Not Found] CHR HKU\S-1-5-21-796845957-329068152-1801674531-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [jmlmanpnnbnpabnonijjmnmplnbfcgbf] - C:\Program Files\NetPanel\chromegem.crx [2011-12-25] FF HKU\S-1-5-21-796845957-329068152-1801674531-1003\...\Firefox\Extensions: [gemgecko@gemius.com] - C:\Program Files\NetPanel\gemgecko_ext FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension HKLM\...\Run: [KernelFaultCheck] => %systemroot%\system32\dumprep 0 -k Startup: C:\Documents and Settings\komputer\Menu Start\Programy\Autostart\OPTISetup.lnk BootExecute: autocheck autochk * ROBoot \??\C:\WINDOWS\system32\ASOROSet.binDfSDKBt S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] S4 sptd; \SystemRoot\System32\Drivers\sptd.sys [X] S3 WinRing0_1_2_0; \??\C:\Program Files\Razer\Razer Game Booster\Driver\WinRing0.sys [X] AV: STOPzilla AntiVirus (Disabled - Up to date) {271A6322-9DAA-4E02-932D-7EDF389FFCF0} C:\Documents and Settings\All Users\Dane aplikacji\STOPzilla! C:\Documents and Settings\All Users\Dane aplikacji\{41dd2fbb-aaaf-3438-41dd-d2fbbaaabeee} C:\Documents and Settings\All Users\Dane aplikacji\f692c51800004be1 C:\Documents and Settings\All Users\Dane aplikacji\InstallMate C:\Documents and Settings\komputer\Dane aplikacji\Logs C:\Program Files\NetPanel C:\Program Files\STOPzilla C:\WINDOWS\46B04D534E344388B6EE80FAB66AEF9B.TMP C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension C:\WINDOWS\system32\Drivers\etc\hosts.*.backup Hosts: Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Reader Speed Launcher" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AlcoholAutomount" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DAEMON Tools Lite" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\GB_UPDATE" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\GEST" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMMON " /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\KernelFaultCheck" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NetPanel" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SpybotSD TeaTimer" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SunJavaUpdateSched" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\vProt" /f Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f CMD: ipconfig /flushdns EmptyTemp: ***************** Processes closed successfully. Error: (0) Failed to create a restore point. C:\Documents and Settings\All Users\Menu Start\Programy\Google Chrome\Google Chrome.lnk => Shortcut argument was removed successfully. C:\Documents and Settings\komputer\Menu Start\Programy\Akcesoria\NarzÄ™dzia systemowe\Internet Explorer (bez dodatków).lnk => Shortcut argument was restored successfully. C:\Documents and Settings\komputer\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk => Shortcut argument was removed successfully. C:\Documents and Settings\komputer\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Uruchom przeglÄ…darkÄ™ Internet Explorer.lnk => Shortcut argument was removed successfully. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully. C:\WINDOWS\system32\GroupPolicy\Machine => Moved successfully. C:\WINDOWS\system32\GroupPolicy\GPT.ini => Moved successfully. "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully. "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Local Page => Value was restored successfully. HKU\S-1-5-21-796845957-329068152-1801674531-1003\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKU\S-1-5-21-796845957-329068152-1801674531-1003\Software\Microsoft\Internet Explorer\Main\\Search Bar => value deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\\Tabs => Value was restored successfully. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{632F07F3-19A1-4d16-A23F-E6CE9486BAB5}" => Key deleted successfully. HKCR\CLSID\{632F07F3-19A1-4d16-A23F-E6CE9486BAB5} => Key not found. "HKU\S-1-5-21-796845957-329068152-1801674531-1003\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{632F07F3-19A1-4d16-A23F-E6CE9486BAB5}" => Key deleted successfully. HKCR\CLSID\{632F07F3-19A1-4d16-A23F-E6CE9486BAB5} => Key not found. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value deleted successfully. HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Key not found. "HKU\S-1-5-21-796845957-329068152-1801674531-1003_Classes\CLSID\{1FAF8C54-31AE-FA45-9103-120A098EDA98}" => Key deleted successfully. "HKU\S-1-5-21-796845957-329068152-1801674531-1003_Classes\CLSID\{3A3A3278-4E97-0008-4E1B-6DDDDD51BE9F}" => Key deleted successfully. "HKU\S-1-5-21-796845957-329068152-1801674531-1003_Classes\CLSID\{ADCC7130-C0AA-41F2-7268-D6F2DB5DEC02}" => Key deleted successfully. "HKLM\SOFTWARE\Google\Chrome\Extensions\nonnbhnjfhfcpmfdegkohnemghnglgpp" => Key deleted successfully. HKU\S-1-5-21-796845957-329068152-1801674531-1003\SOFTWARE\Google\Chrome\Extensions\jmlmanpnnbnpabnonijjmnmplnbfcgbf => Key not found. "C:\Program Files\NetPanel\chromegem.crx" => File/Directory not found. HKU\S-1-5-21-796845957-329068152-1801674531-1003\Software\Mozilla\Firefox\Extensions\\gemgecko@gemius.com => Value not found. HKLM\Software\Mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b} => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\KernelFaultCheck => value deleted successfully. C:\Documents and Settings\komputer\Menu Start\Programy\Autostart\OPTISetup.lnk => Moved successfully. HKLM\System\CurrentControlSet\Control\Session Manager\\BootExecute => Value was restored successfully. esgiguard => Service deleted successfully. sptd => Service deleted successfully. WinRing0_1_2_0 => Service deleted successfully. AV: STOPzilla AntiVirus (Disabled - Up to date) {271A6322-9DAA-4E02-932D-7EDF389FFCF0} => The item is protected. Make sure the software is uninstalled and its services are removed. C:\Documents and Settings\All Users\Dane aplikacji\STOPzilla! => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\{41dd2fbb-aaaf-3438-41dd-d2fbbaaabeee} => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\f692c51800004be1 => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\InstallMate => Moved successfully. C:\Documents and Settings\komputer\Dane aplikacji\Logs => Moved successfully. C:\Program Files\NetPanel => Moved successfully. C:\Program Files\STOPzilla => Moved successfully. C:\WINDOWS\46B04D534E344388B6EE80FAB66AEF9B.TMP => Moved successfully. C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension => Moved successfully. C:\WINDOWS\system32\Drivers\etc\hosts.*.backup => Moved successfully. C:\Windows\System32\Drivers\etc\hosts => Moved successfully. Hosts was reset successfully. ========= reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Reader Speed Launcher" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AlcoholAutomount" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DAEMON Tools Lite" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\GB_UPDATE" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\GEST" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMMON " /f ========= BÅ‚Ä…d: system nie może odnaleźć okreÅ›lonego klucza rejestru lub wartoÅ›ci. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\KernelFaultCheck" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NetPanel" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SpybotSD TeaTimer" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SunJavaUpdateSched" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\vProt" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= ipconfig /flushdns ========= Konfiguracja IP systemu Windows Pomyœlnie opró¿niono pamiêæ podrêczn¹ programu rozpoznawania nazw DNS. ========= End of CMD: ========= EmptyTemp: => Removed 232 MB temporary data. The system needed a reboot. ==== End of Fixlog 16:47:10 ====