Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 02-05-2015 Ran by Edytka at 2015-05-05 11:11:12 Run:1 Running from C:\Documents and Settings\Edytka\Pulpit Loaded Profiles: Edytka (Available profiles: Edytka & Administrator & Gość) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: CreateRestorePoint: HKLM\...\Run: [] => [X] HKU\S-1-5-21-57989841-329068152-725345543-1004\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/ CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{0000002F-0000-0000-C000-000000000046}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{0002E005-0000-0000-C000-000000000046}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{0BE35204-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{46763EE0-CAB2-11CE-8C20-00AA0051E5D4}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE33-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE34-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE35-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE39-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE3C-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE3D-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path CustomCLSID: HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\InprocServer32 -> No File Path S2 AVUpdate; C:\PROGRA~1\ArcaBit\ARCAUP~1\update.exe [X] U2 CertPropSvc; No ImagePath S1 mailKmd; No ImagePath S1 Wbutton; \SystemRoot\system32\drivers\Wbutton.sys [X] U1 WS2IFSL; No ImagePath DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 C:\Documents and Settings\Edytka\Dane aplikacji\Smiley.ico C:\Documents and Settings\Edytka\Ustawienia lokalne\Dane aplikacji\Kosong.Bron.Tok.txt C:\Documents and Settings\Edytka\Ustawienia lokalne\Dane aplikacji\ListHost9.txt RemoveDirectory: C:\Recycler RemoveDirectory: D:\Recycled CMD: netsh firewall reset CMD: dir /a C:\ CMD: dir /a D:\ Hosts: EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully. HKU\S-1-5-21-57989841-329068152-725345543-1004\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{0000002F-0000-0000-C000-000000000046}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{00020420-0000-0000-C000-000000000046}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{00020421-0000-0000-C000-000000000046}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{00020422-0000-0000-C000-000000000046}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{00020423-0000-0000-C000-000000000046}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{00020424-0000-0000-C000-000000000046}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{00020425-0000-0000-C000-000000000046}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{0002E005-0000-0000-C000-000000000046}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{0BE35203-8F91-11CE-9DE3-00AA004BB851}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{0BE35204-8F91-11CE-9DE3-00AA004BB851}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{46763EE0-CAB2-11CE-8C20-00AA0051E5D4}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE33-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE34-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE35-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE39-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE3C-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE3D-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}" => Key deleted successfully. "HKU\S-1-5-21-57989841-329068152-725345543-1004_Classes\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}" => Key deleted successfully. AVUpdate => Service deleted successfully. CertPropSvc => Service deleted successfully. mailKmd => Service deleted successfully. Wbutton => Service deleted successfully. WS2IFSL => Service deleted successfully. HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 => Failed to delete key at first attempt (Error: C0000121), see next line. HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 => Key Deleted Successfully. C:\Documents and Settings\Edytka\Dane aplikacji\Smiley.ico => Moved successfully. C:\Documents and Settings\Edytka\Ustawienia lokalne\Dane aplikacji\Kosong.Bron.Tok.txt => Moved successfully. C:\Documents and Settings\Edytka\Ustawienia lokalne\Dane aplikacji\ListHost9.txt => Moved successfully. "C:\Recycler" => removed successfully. "D:\Recycled" => removed successfully. ========= netsh firewall reset ========= Ok. ========= End of CMD: ========= ========= dir /a C:\ ========= Wolumin w stacji C nie ma etykiety. Numer seryjny woluminu: 1C6F-9522 Katalog: C:\ 2009-01-12 09:13 2ÿ101 31-canad-podpis.pem 2009-01-12 09:13 2ÿ296 33-cazew-podpis.pem 2011-11-27 15:56 Acer 2012-03-05 22:21 archiwum 2015-03-31 21:35 7 AUTOEXEC.BAT 2011-02-06 14:11 121 autorun.inf 2015-04-01 08:27 Avenger 2008-07-30 19:15 211 boot.ini 2004-08-04 14:00 4ÿ952 Bootfont.bin 2015-05-05 11:02 Config.Msi 2008-07-30 19:24 0 CONFIG.SYS 2009-08-10 12:34 8ÿ220 CRL_OZK32.crl 2015-03-31 20:59 Documents and Settings 2008-07-31 12:03 dzwiek 2011-07-26 08:04 found.000 2015-05-05 11:10 FRST 2008-07-30 19:24 0 IO.SYS 2008-07-30 19:24 0 MSDOS.SYS 2008-09-07 16:52 MSOCache 2008-07-31 14:42 Nowy folder 2004-08-04 14:00 47ÿ564 NTDETECT.COM 2004-08-04 14:00 250ÿ624 ntldr 2009-08-10 12:34 1ÿ136 OZK32_centrast.der 2015-05-05 10:32 390ÿ070ÿ272 pagefile.sys 2013-02-11 13:33 13ÿ030 PDOXUSRS.NET 2010-04-07 22:57 2ÿ256 PE-1-ZUS-EWD.pem 2012-06-04 20:12 PODATKI 2015-03-30 13:31 pom 2015-05-05 11:06 Program Files 2015-04-01 07:21 Recycled 2008-07-30 19:29 System Volume Information 2015-04-01 08:40 119ÿ212 TDSSKiller.3.0.0.44_01.04.2015_08.37.53_log.txt 2015-05-03 22:27 119ÿ064 TDSSKiller.3.0.0.44_03.05.2015_22.25.57_log.txt 2012-02-18 21:11 temp 2015-05-05 10:37 WINDOWS 18 plik(¢w) 390ÿ641ÿ066 bajt¢w 17 katalog(¢w) 12ÿ526ÿ239ÿ744 bajt¢w wolnych ========= End of CMD: ========= ========= dir /a D:\ ========= Wolumin w stacji D to ACERDATA Numer seryjny woluminu: 021B-1BEC Katalog: D:\ 2011-02-06 13:29 103 autorun.inf 2006-01-27 19:37 System Volume Information 2011-05-03 22:09 e48aa6e24b54c51fc5e9171aae 2011-02-05 14:56 6ÿ307ÿ840 Archiwum_WAPRO_20110205_1456.ape 2011-02-18 08:18 wspolnoty_bazan 2011-02-18 16:24 31ÿ689ÿ284 wspolnoty_bazan.zip 2008-07-29 21:44 433 walk.avi.ini 4 plik(¢w) 37ÿ997ÿ660 bajt¢w 3 katalog(¢w) 27ÿ310ÿ587ÿ904 bajt¢w wolnych ========= End of CMD: ========= C:\Windows\System32\Drivers\etc\hosts => Moved successfully. Hosts was reset successfully. EmptyTemp: => Removed 942.2 MB temporary data. The system needed a reboot. ==== End of Fixlog 11:16:09 ====