Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-02-2015 Ran by Hubert at 2015-02-23 17:25:30 Run:1 Running from C:\Users\Hubert\Downloads Loaded Profiles: Hubert (Available profiles: Hubert & UpdatusUser) Boot Mode: Normal ============================================== Content of fixlist: ***************** CreateRestorePoint: DisableService: cmderd DisableService: cmdGuard DisableService: cmdHlp DisableService: inspect R2 svcgdp; C:\Program Files (x86)\Software Plate\svcgdp.exe [224416 2012-07-02] (Beijing ELEX Technology Co., Ltd.) S2 CmdAgent; No ImagePath S3 cmdvirth; No ImagePath S0 sptd; No ImagePath S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [X] Task: {02A1542D-7D16-4DCE-AB12-C272E49A9CDE} - System32\Tasks\Microsoft\Windows\Maintenance\SMupdate2 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update2 <==== ATTENTION Task: {43E4C5BE-9452-41CE-86C7-AE94599105B9} - System32\Tasks\{21CD9D93-ABB2-489A-8262-D8B77702CF95} => Chrome.exe http://ui.skype.com/ui/0/6.20.0.104/pl/abandoninstall?page=tsPlugin Task: {4659A0DE-EBF9-44E0-A1FF-45F375FB0D3A} - System32\Tasks\{8257FDA3-FEB3-48DA-BEA8-988202248EAE} => Chrome.exe http://ui.skype.com/ui/0/6.16.0.105/pl/abandoninstall?page=tsProgressBar Task: {56DEA540-7757-401F-97D9-ED4258460741} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe Task: {89F8E6C7-557D-46DA-B820-EE6EADFCD779} - System32\Tasks\{42533AC2-D226-47A5-AECF-32F839DAD083} => Firefox.exe http://www.skype.com/go/downloading?source=lightinstaller&ver=5.5.0.117&LastError=404 Task: {91699E04-0D45-4679-ACCE-293F87A59317} - System32\Tasks\{D23F55FA-EED9-4199-87BB-EE3AC7C3FAF7} => Firefox.exe http://ui.skype.com/ui/0/6.1.0.129.272/pl/abandoninstall?page=tsProgressBar Task: {AC34A251-84BB-4560-BBAF-797E1C7A6354} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe Task: {AF507756-D567-48B4-8411-567252FA5894} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe Task: {C97BE190-22D0-43B5-A192-9D1CB4AD6CC1} - System32\Tasks\Microsoft\Windows\Multimedia\SMupdate3 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update3 <==== ATTENTION Task: {ED30B592-DBEA-4A4A-B300-73BC2DC2BAE6} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe Task: {EDA7E35B-78AC-45D0-A3F8-E806870F55E6} - System32\Tasks\Driver Booster SkipUAC (Hubert) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe Task: {FE6D46D0-C76E-4D1A-9ADF-4430E4803B13} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe CHR HKU\S-1-5-21-3305830765-1307672135-6286609-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION CHR HomePage: Default -> hxxp://isearch.omiga-plus.com/?type=hp&ts=1421438541&from=cor&uid=ST31000524AS_6VPCCGGSXXXX6VPCCGGS HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = HKU\S-1-5-21-3305830765-1307672135-6286609-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com URLSearchHook: HKU\S-1-5-21-3305830765-1307672135-6286609-1001 - (No Name) - {5bcf818d-78c8-41b8-ba89-65c5fdac4fc4} - No File Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File C:\Program Files\COMODO C:\Program Files\Common Files\System\SysMenu.dll C:\Program Files (x86)\Mozilla Firefox\plugins C:\Program Files (x86)\Software Plate C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk C:\ProgramData\TEMP C:\Users\Hubert\AppData\Local\newhb2.crx C:\Users\Hubert\Downloads\AdwCleaner*.exe C:\Users\Public\Desktop\Google Chrome.lnk C:\Users\UpdatusUser\Desktop\*.lnk C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup C:\Windows\pss\Start GeekBuddy.lnk.CommonStartup C:\Windows\System32\Tasks\COMODO DeleteKey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\COMODO Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Start GeekBuddy.lnk" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnTBMon" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MKLOL" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NextLive" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SearchSettings" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TkBellExe" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TrojanScanner" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\tvncontrol" /f Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f EmptyTemp: ***************** Restore point was successfully created. cmderd service was disabled cmdGuard service was disabled cmdHlp service was disabled inspect service was disabled svcgdp => Unable to stop service svcgdp => Service deleted successfully. CmdAgent => Error deleting Service cmdvirth => Service deleted successfully. sptd => Service deleted successfully. WinRing0_1_2_0 => Service deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{02A1542D-7D16-4DCE-AB12-C272E49A9CDE}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{02A1542D-7D16-4DCE-AB12-C272E49A9CDE}" => Key deleted successfully. C:\Windows\System32\Tasks\Microsoft\Windows\Maintenance\SMupdate2 => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Maintenance\SMupdate2" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{43E4C5BE-9452-41CE-86C7-AE94599105B9}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{43E4C5BE-9452-41CE-86C7-AE94599105B9}" => Key deleted successfully. C:\Windows\System32\Tasks\{21CD9D93-ABB2-489A-8262-D8B77702CF95} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{21CD9D93-ABB2-489A-8262-D8B77702CF95}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4659A0DE-EBF9-44E0-A1FF-45F375FB0D3A}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4659A0DE-EBF9-44E0-A1FF-45F375FB0D3A}" => Key deleted successfully. C:\Windows\System32\Tasks\{8257FDA3-FEB3-48DA-BEA8-988202248EAE} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{8257FDA3-FEB3-48DA-BEA8-988202248EAE}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{56DEA540-7757-401F-97D9-ED4258460741}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{56DEA540-7757-401F-97D9-ED4258460741}" => Key deleted successfully. C:\Windows\System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{89F8E6C7-557D-46DA-B820-EE6EADFCD779}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{89F8E6C7-557D-46DA-B820-EE6EADFCD779}" => Key deleted successfully. C:\Windows\System32\Tasks\{42533AC2-D226-47A5-AECF-32F839DAD083} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{42533AC2-D226-47A5-AECF-32F839DAD083}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{91699E04-0D45-4679-ACCE-293F87A59317}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{91699E04-0D45-4679-ACCE-293F87A59317}" => Key deleted successfully. C:\Windows\System32\Tasks\{D23F55FA-EED9-4199-87BB-EE3AC7C3FAF7} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{D23F55FA-EED9-4199-87BB-EE3AC7C3FAF7}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{AC34A251-84BB-4560-BBAF-797E1C7A6354}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AC34A251-84BB-4560-BBAF-797E1C7A6354}" => Key deleted successfully. C:\Windows\System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AF507756-D567-48B4-8411-567252FA5894}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AF507756-D567-48B4-8411-567252FA5894}" => Key deleted successfully. C:\Windows\System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{C97BE190-22D0-43B5-A192-9D1CB4AD6CC1}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C97BE190-22D0-43B5-A192-9D1CB4AD6CC1}" => Key deleted successfully. C:\Windows\System32\Tasks\Microsoft\Windows\Multimedia\SMupdate3 => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Multimedia\SMupdate3" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{ED30B592-DBEA-4A4A-B300-73BC2DC2BAE6}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ED30B592-DBEA-4A4A-B300-73BC2DC2BAE6}" => Key deleted successfully. C:\Windows\System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{EDA7E35B-78AC-45D0-A3F8-E806870F55E6}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EDA7E35B-78AC-45D0-A3F8-E806870F55E6}" => Key deleted successfully. C:\Windows\System32\Tasks\Driver Booster SkipUAC (Hubert) => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Driver Booster SkipUAC (Hubert)" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{FE6D46D0-C76E-4D1A-9ADF-4430E4803B13}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FE6D46D0-C76E-4D1A-9ADF-4430E4803B13}" => Key deleted successfully. C:\Windows\System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}" => Key deleted successfully. "HKU\S-1-5-21-3305830765-1307672135-6286609-1001\SOFTWARE\Policies\Google" => Key deleted successfully. Chrome HomePage deleted successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Local Page => Value was restored successfully. HKU\S-1-5-21-3305830765-1307672135-6286609-1001\Software\Microsoft\Internet Explorer\Main\\Search Bar => value deleted successfully. HKU\S-1-5-21-3305830765-1307672135-6286609-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{5bcf818d-78c8-41b8-ba89-65c5fdac4fc4} => value deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} => value deleted successfully. "HKCR\CLSID\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}" => Key deleted successfully. "HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin" => Key deleted successfully. C:\Program Files\COMODO => Moved successfully. "C:\Program Files\Common Files\System\SysMenu.dll" => File/Directory not found. C:\Program Files (x86)\Mozilla Firefox\plugins => Moved successfully. C:\Program Files (x86)\Software Plate => Moved successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo => Moved successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk => Moved successfully. C:\ProgramData\TEMP => Moved successfully. C:\Users\Hubert\AppData\Local\newhb2.crx => Moved successfully. C:\Users\Hubert\Downloads\AdwCleaner*.exe => Moved successfully. C:\Users\Public\Desktop\Google Chrome.lnk => Moved successfully. C:\Users\UpdatusUser\Desktop\*.lnk => Moved successfully. C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup => Moved successfully. C:\Windows\pss\Start GeekBuddy.lnk.CommonStartup => Moved successfully. C:\Windows\System32\Tasks\COMODO => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\COMODO => Key Deleted successfully. ========= reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Start GeekBuddy.lnk" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnTBMon" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MKLOL" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NextLive" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SearchSettings" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TkBellExe" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TrojanScanner" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\tvncontrol" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= EmptyTemp: => Removed 191.1 MB temporary data. The system needed a reboot. ==== End of Fixlog 17:26:23 ====