Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 23-02-2015 01 Ran by SysOp at 2015-02-24 17:02:26 Run:2 Running from D:\pobrane Loaded Profiles: SysOp (Available profiles: SysOp & Administrator) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.key-find.com/?type=hp&ts=1424203077&from=cor&uid=ST3500418AS_5VM1Q44VXXXX5VM1Q44V HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com/web/?type=ds&ts=1424203077&from=cor&uid=ST3500418AS_5VM1Q44VXXXX5VM1Q44V&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.key-find.com/?type=hp&ts=1424203077&from=cor&uid=ST3500418AS_5VM1Q44VXXXX5VM1Q44V HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com/web/?type=ds&ts=1424203077&from=cor&uid=ST3500418AS_5VM1Q44VXXXX5VM1Q44V&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = HKU\S-1-5-21-1409082233-651377827-1177238915-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.key-find.com/?type=hp&ts=1424203077&from=cor&uid=ST3500418AS_5VM1Q44VXXXX5VM1Q44V HKU\S-1-5-21-1409082233-651377827-1177238915-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.key-find.com/?type=hp&ts=1424203077&from=cor&uid=ST3500418AS_5VM1Q44VXXXX5VM1Q44V URLSearchHook: [S-1-5-21-1409082233-651377827-1177238915-1001] ATTENTION ==> Default URLSearchHook is missing. SearchScopes: HKU\S-1-5-21-1409082233-651377827-1177238915-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.key-find.com/web/?type=ds&ts=1424203077&from=cor&uid=ST3500418AS_5VM1Q44VXXXX5VM1Q44V&q={searchTerms} BHO: Internet Program -> {ff0021ad-2cc3-4e0d-8e3c-b4153a64a495} -> C:\Program Files\Internet Program\Extensions\ff0021ad-2cc3-4e0d-8e3c-b4153a64a495.dll () Toolbar: HKLM - No Name - {37B85A29-692B-4205-9CAD-2626E4993404} - No File Toolbar: HKU\S-1-5-21-1409082233-651377827-1177238915-1001 -> No Name - {37B85A29-692B-4205-9CAD-2626E4993404} - No File ShellIconOverlayIdentifiers: [GGDriveOverlay1] -> {E68D0A50-3C40-4712-B90D-DCFA93FF2534} => No File ShellIconOverlayIdentifiers: [GGDriveOverlay2] -> {E68D0A51-3C40-4712-B90D-DCFA93FF2534} => No File ShellIconOverlayIdentifiers: [GGDriveOverlay3] -> {E68D0A52-3C40-4712-B90D-DCFA93FF2534} => No File ShellIconOverlayIdentifiers: [GGDriveOverlay4] -> {E68D0A53-3C40-4712-B90D-DCFA93FF2534} => No File FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF HKLM\...\Firefox\Extensions: [searchengine@gmail.com] - C:\Documents and Settings\SysOp\Dane aplikacji\Mozilla\Firefox\Profiles\nukl7zsu.default\extensions\searchengine@gmail.com FF HKLM\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Documents and Settings\SysOp\Dane aplikacji\Mozilla\Firefox\Profiles\nukl7zsu.default\extensions\faststartff@gmail.com Task: C:\WINDOWS\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\WINDOWS\TEMP\{A68C16E5-74BB-40C8-8CD6-8C54B826F14E}.exe <==== ATTENTION HKLM\...\Policies\Explorer: [NoCDBurning] 0 HKLM\...\Policies\Explorer: [NoDriveTypeAutoRun ] 0 HKLM\...\Policies\Explorer: [NoViewContextMenu ] 0 HKU\S-1-5-21-1409082233-651377827-1177238915-1001\...\Run: [Clownfish] => [X] S4 WindowsMangerProtect; C:\Documents and Settings\All Users\Dane aplikacji\WindowsMangerProtect\ProtectWindowsManager.exe -service [X] S3 BT; system32\DRIVERS\btnetdrv.sys [X] S3 Btcsrusb; System32\Drivers\btcusb.sys [X] S1 ccnfd_1_10_0_5; system32\drivers\ccnfd_1_10_0_5.sys [X] S3 usbbus; system32\DRIVERS\lgusbbus.sys [X] S3 UsbDiag; system32\DRIVERS\lgusbdiag.sys [X] S3 USBModem; system32\DRIVERS\lgusbmodem.sys [X] S3 VComm; system32\DRIVERS\VComm.sys [X] S3 VcommMgr; System32\Drivers\VcommMgr.sys [X] S3 VHidMinidrv; system32\drivers\VHIDMini.sys [X] C:\Jumpshot C:\Documents and Settings\All Users\Dane aplikacji\6fb1f30a-cea7-4ccf-bff8-acbecbfe46f9 C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{F024ED5C-33A4-469D-9CEA-B29D14E7F29C} C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{ED436EA8-4145-4703-AE5D-4D09DD24AF5A} C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{CC41E216-BBA8-487F-8213-4AA2CFDF61A3} C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{C28385C1-6D64-4F5A-AAAA-203C4EC383EA} C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8} C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{901A8C82-9A9E-4B8B-B88A-C6E8EC41BB3A} C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{34D81777-850B-49BF-9A1E-84578F6FA5CD} C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{32AA290A-D053-46F5-839A-CEF4479D9280} C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{03A019EE-9BF6-4E7F-8460-A8FEBD03073B} C:\Documents and Settings\All Users\Dane aplikacji\TEMP C:\Documents and Settings\All Users\Dane aplikacji\WindowsMangerProtect C:\Documents and Settings\All Users\Menu Start\Programy\cdp.pl C:\Documents and Settings\All Users\Menu Start\Programy\Windows Resource Kit Tools\Windows Resource Kit Tools Help.lnk C:\Documents and Settings\All Users\Pulpit\Farming Simulator 2013.lnk C:\Documents and Settings\SysOp\Dane aplikacji\DAEMON Tools Lite C:\Documents and Settings\SysOp\Dane aplikacji\key-find C:\Documents and Settings\SysOp\Moje dokumenty\Euro Truck Simulator 2\readme.rtf.lnk C:\Documents and Settings\SysOp\Ustawienia lokalne\Dane aplikacji\Google C:\Program Files\Common Files\6fb1f30a-cea7-4ccf-bff8-acbecbfe46f9 C:\Program Files\Internet Program C:\Program Files\Mozilla Firefoxavg-secure-search.xml C:\Program Files\Mozilla Firefox\extensions C:\Program Files\mozilla firefox\plugins C:\WINDOWS\jumpshot.com C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension Hosts: CMD: ipconfig /flushdns CMD: netsh firewall reset Reg: reg delete HKCU\Software\Google /f Reg: reg delete HKLM\SOFTWARE\Google /f Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f Reg: reg delete HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /f Reg: reg delete HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /f Reg: reg delete HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /f Reg: reg delete "HKCU\Software\Microsoft\Internet Explorer\Search" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Search" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Clownfish" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DAEMON Tools Lite" /f Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\vProt" /f Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main" /f Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f EmptyTemp: ***************** Processes closed successfully. "C:\WINDOWS\system32\GroupPolicy\Machine" => File/Directory not found. HKLM\SOFTWARE\Policies\Google => Key not found. HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => Key not found. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Local Page => Value was restored successfully. HKU\S-1-5-21-1409082233-651377827-1177238915-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKU\S-1-5-21-1409082233-651377827-1177238915-1001\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. Error setting Default URLSearchHook. HKU\S-1-5-21-1409082233-651377827-1177238915-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ff0021ad-2cc3-4e0d-8e3c-b4153a64a495} => Key not found. "HKCR\CLSID\{ff0021ad-2cc3-4e0d-8e3c-b4153a64a495}" => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{37B85A29-692B-4205-9CAD-2626E4993404} => value deleted successfully. HKCR\CLSID\{37B85A29-692B-4205-9CAD-2626E4993404} => Key not found. HKU\S-1-5-21-1409082233-651377827-1177238915-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{37B85A29-692B-4205-9CAD-2626E4993404} => value deleted successfully. HKCR\CLSID\{37B85A29-692B-4205-9CAD-2626E4993404} => Key not found. "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\GGDriveOverlay1" => Key deleted successfully. HKCR\CLSID\{E68D0A50-3C40-4712-B90D-DCFA93FF2534} => Key not found. "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\GGDriveOverlay2" => Key deleted successfully. HKCR\CLSID\{E68D0A51-3C40-4712-B90D-DCFA93FF2534} => Key not found. "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\GGDriveOverlay3" => Key deleted successfully. HKCR\CLSID\{E68D0A52-3C40-4712-B90D-DCFA93FF2534} => Key not found. "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\GGDriveOverlay4" => Key deleted successfully. HKCR\CLSID\{E68D0A53-3C40-4712-B90D-DCFA93FF2534} => Key not found. HKLM\Software\Mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b} => value deleted successfully. HKLM\Software\Mozilla\Firefox\Extensions\\searchengine@gmail.com => value deleted successfully. HKLM\Software\Mozilla\Firefox\Extensions\\faststartff@gmail.com => Value not found. C:\WINDOWS\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => Moved successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoCDBurning => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoDriveTypeAutoRun => value deleted successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoViewContextMenu => value deleted successfully. HKU\S-1-5-21-1409082233-651377827-1177238915-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Clownfish => value deleted successfully. WindowsMangerProtect => Service not found. BT => Service deleted successfully. Btcsrusb => Service deleted successfully. ccnfd_1_10_0_5 => Service deleted successfully. usbbus => Service deleted successfully. UsbDiag => Service deleted successfully. USBModem => Service deleted successfully. VComm => Service deleted successfully. VcommMgr => Service deleted successfully. VHidMinidrv => Service deleted successfully. C:\Jumpshot => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\6fb1f30a-cea7-4ccf-bff8-acbecbfe46f9 => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{F024ED5C-33A4-469D-9CEA-B29D14E7F29C} => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{ED436EA8-4145-4703-AE5D-4D09DD24AF5A} => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{CC41E216-BBA8-487F-8213-4AA2CFDF61A3} => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{C28385C1-6D64-4F5A-AAAA-203C4EC383EA} => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8} => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{901A8C82-9A9E-4B8B-B88A-C6E8EC41BB3A} => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{34D81777-850B-49BF-9A1E-84578F6FA5CD} => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{32AA290A-D053-46F5-839A-CEF4479D9280} => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Windows\GameExplorer\{03A019EE-9BF6-4E7F-8460-A8FEBD03073B} => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\TEMP => Moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\WindowsMangerProtect => Moved successfully. C:\Documents and Settings\All Users\Menu Start\Programy\cdp.pl => Moved successfully. C:\Documents and Settings\All Users\Menu Start\Programy\Windows Resource Kit Tools\Windows Resource Kit Tools Help.lnk => Moved successfully. C:\Documents and Settings\All Users\Pulpit\Farming Simulator 2013.lnk => Moved successfully. C:\Documents and Settings\SysOp\Dane aplikacji\DAEMON Tools Lite => Moved successfully. C:\Documents and Settings\SysOp\Dane aplikacji\key-find => Moved successfully. C:\Documents and Settings\SysOp\Moje dokumenty\Euro Truck Simulator 2\readme.rtf.lnk => Moved successfully. C:\Documents and Settings\SysOp\Ustawienia lokalne\Dane aplikacji\Google => Moved successfully. C:\Program Files\Common Files\6fb1f30a-cea7-4ccf-bff8-acbecbfe46f9 => Moved successfully. C:\Program Files\Internet Program => Moved successfully. C:\Program Files\Mozilla Firefoxavg-secure-search.xml => Moved successfully. C:\Program Files\Mozilla Firefox\extensions => Moved successfully. C:\Program Files\mozilla firefox\plugins => Moved successfully. C:\WINDOWS\jumpshot.com => Moved successfully. C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension => Moved successfully. C:\Windows\System32\Drivers\etc\hosts => Moved successfully. Hosts was reset successfully. ========= ipconfig /flushdns ========= Konfiguracja IP systemu Windows Pomyœlnie opró¿niono pamiêæ podrêczn¹ programu rozpoznawania nazw DNS. ========= End of CMD: ========= ========= netsh firewall reset ========= Nie mo¾na zaˆadowa† nast©puj¥cego pomocnika DLL: DGNET.DLL. Ok. ========= End of CMD: ========= ========= reg delete HKCU\Software\Google /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Google /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKCU\Software\Microsoft\Internet Explorer\Search" /f ========= BÅ‚Ä…d: system nie może odnaleźć okreÅ›lonego klucza rejestru lub wartoÅ›ci. ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\Search" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Clownfish" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DAEMON Tools Lite" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\vProt" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoÅ„czona pomyÅ›lnie ========= End of Reg: ========= EmptyTemp: => Removed 710.5 MB temporary data. The system needed a reboot. ==== End of Fixlog 17:03:01 ====