Fix result of Farbar Recovery Scan Tool (x64) Version:29-11-2015 Ran by Artur (2015-11-30 15:21:40) Run:1 Running from C:\FRST\FRST-OlderVersion\FRST-OlderVersion Loaded Profiles: Artur (Available Profiles: Artur) Boot Mode: Normal ============================================== fixlist content: ***************** CloseProcesses: CreateRestorePoint: S4 downlsad; C:\Users\Artur\AppData\Local\Zottechi.exe [46592 2015-11-26] () [File not signed] S2 1a34a8e0; "C:\Windows\system32\rundll32.exe" "c:\progra~2\SNSvc.dll",service S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [X] S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X] S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X] HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Xesmitge => ""="service" HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\...\Run: [ALLUpdate] => "C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe" "sleep" HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\...\Run: [ChomikBox] => C:\Program Files (x86)\ChomikBox\chomikbox.exe HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\...\Run: [HTC Home Widget] => C:\Program Files\HTC Home\HTCHome.exe HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\...\Run: [ChicaPasswordManager] => "C:\Program Files (x86)\ChicaLogic\Chica Password Manager\stpass.exe" /autorunned HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\...\Run: [KiesPDLR.exe] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\...\RunOnce: [Adobe Speed Launcher] => 1448881532 HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE -> HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE -> Task: {476F56CA-80B3-46D0-AD77-C1663359EC66} - \SN.Booster-S-1532781606 -> No File <==== ATTENTION Task: {650703A3-D789-491B-A84A-D337BD5AF22E} - System32\Tasks\{1FC95851-41CB-4A38-AD8E-0BB1249B0C33} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/8980 Task: {9F15FC93-DAEF-4A69-9657-4AE785788497} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.0.43\SymErr.exe Task: {A720DE49-D3A2-4BA6-BC8F-B3F308A5108A} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.0.43\SymErr.exe CHR HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Artur\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2014-03-14] CHR HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=pl&pid=NIS&pvid=22.5.5.15 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=pl&pid=NIS&pvid=22.5.5.15 HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm Toolbar: HKU\S-1-5-21-3076302344-2742556548-4197340800-1000 -> No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File DeleteKey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Doctor Web C:\Program Files (x86)\DivX C:\Program Files (x86)\Mozilla Firefox C:\Program Files (x86)\Opera C:\ProgramData\AVAST Software C:\ProgramData\AVG C:\ProgramData\DivX C:\ProgramData\TEMP C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced Anti Keylogger C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GRemote C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Medieval 2 Total War Gold C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paradox Interactive\Hearts of Iron III Gold C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warships C:\uninst C:\Users\Artur\AppData\Local\Zottechi.exe C:\Users\Artur\AppData\Local\Zottechi.exe.config C:\Users\Artur\AppData\Local\Avg C:\Users\Artur\AppData\Local\Opera Software C:\Users\Artur\AppData\Local\Tempfolder C:\Users\Artur\AppData\Local\Microsoft\Windows\GameExplorer\{6F2514B1-2D81-45FD-AFF8-55E0108B06A7} C:\Users\Artur\AppData\Local\Mozilla\Firefox C:\Users\Artur\AppData\LocalLow\Company C:\Users\Artur\AppData\Roaming\ex_log.txt C:\Users\Artur\AppData\Roaming\AVG C:\Users\Artur\AppData\Roaming\DivX C:\Users\Artur\AppData\Roaming\GoldenGate C:\Users\Artur\AppData\Roaming\Opera Software C:\Users\Artur\AppData\Roaming\WarThunder C:\Users\Artur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Play Sparta - War of empires.lnk C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\*.LNK C:\Users\Artur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DarthMod Empire.lnk C:\Users\Artur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DarthMod Empire C:\Users\Artur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Third Age - Total War 3.0 (Part 1of2) C:\Users\Artur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Third Age - Total War 3.0 (Part 2of2) C:\Users\Artur\AppData\Roaming\Mozilla\Firefox C:\Users\Artur\Desktop\Third Age - Total War.lnk C:\Users\Administrator C:\Users\ASPNET C:\Users\Guest C:\Users\HomeGroupUser$ C:\Users\UpdatusUser C:\Windows\system32\XesmitgeOff.ini C:\Windows\system32\Drivers\etc\hp.bak C:\Windows\System32\Tasks\Doctor Web C:\Windows\SysWOW64\history.dat C:\Windows\SysWOW64\Xesmitge.ini C:\Windows\SysWOW64\XesmitgeOff.ini Reg: reg delete HKCU\Software\Mozilla\Firefox /f Reg: reg delete HKCU\Software\MozillaPlugins /f Reg: reg delete HKLM\SOFTWARE\Mozilla\Firefox /f Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox /f Reg: reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main" /f Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f CMD: ipconfig /flushdns CMD: netsh advfirewall reset EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. downlsad => service removed successfully 1a34a8e0 => service removed successfully ewusbmbb => service removed successfully huawei_enumerator => service removed successfully hwdatacard => service removed successfully "HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Xesmitge" => key removed successfully HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Nvtmru => value removed successfully HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\DivXMediaServer => value removed successfully HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Windows\CurrentVersion\Run\\ALLUpdate => value removed successfully HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Windows\CurrentVersion\Run\\ChomikBox => value removed successfully HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Windows\CurrentVersion\Run\\HTC Home Widget => value removed successfully HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Windows\CurrentVersion\Run\\ChicaPasswordManager => value removed successfully HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Windows\CurrentVersion\Run\\KiesPDLR.exe => value removed successfully HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Adobe Speed Launcher => value removed successfully HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Control Panel\Desktop\\SCRNSAVE.EXE => value removed successfully HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE => value removed successfully HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE => value removed successfully HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE => value removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{476F56CA-80B3-46D0-AD77-C1663359EC66}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{476F56CA-80B3-46D0-AD77-C1663359EC66}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SN.Booster-S-1532781606" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{650703A3-D789-491B-A84A-D337BD5AF22E}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{650703A3-D789-491B-A84A-D337BD5AF22E}" => key removed successfully C:\Windows\System32\Tasks\{1FC95851-41CB-4A38-AD8E-0BB1249B0C33} => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{1FC95851-41CB-4A38-AD8E-0BB1249B0C33}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9F15FC93-DAEF-4A69-9657-4AE785788497}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9F15FC93-DAEF-4A69-9657-4AE785788497}" => key removed successfully C:\Windows\System32\Tasks\Norton Identity Safe\Norton Error Analyzer => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Norton Identity Safe\Norton Error Analyzer" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A720DE49-D3A2-4BA6-BC8F-B3F308A5108A}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A720DE49-D3A2-4BA6-BC8F-B3F308A5108A}" => key removed successfully C:\Windows\System32\Tasks\Norton Identity Safe\Norton Error Processor => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Norton Identity Safe\Norton Error Processor" => key removed successfully "HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\SOFTWARE\Google\Chrome\Extensions\apdfllckaahabafndbhieahigkjlhalf" => key removed successfully C:\Users\Artur\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx => moved successfully "HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\SOFTWARE\Google\Chrome\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh" => key removed successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Internet Explorer\Main\\Search Bar => value removed successfully HKU\S-1-5-21-3076302344-2742556548-4197340800-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} => value removed successfully HKCR\CLSID\{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} => key not found. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Doctor Web => key removed successfully C:\Program Files (x86)\DivX => moved successfully C:\Program Files (x86)\Mozilla Firefox => moved successfully C:\Program Files (x86)\Opera => moved successfully C:\ProgramData\AVAST Software => moved successfully C:\ProgramData\AVG => moved successfully C:\ProgramData\DivX => moved successfully C:\ProgramData\TEMP => moved successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced Anti Keylogger => moved successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GRemote => moved successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Medieval 2 Total War Gold => moved successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paradox Interactive\Hearts of Iron III Gold => moved successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3 => moved successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warships => moved successfully C:\uninst => moved successfully C:\Users\Artur\AppData\Local\Zottechi.exe => moved successfully C:\Users\Artur\AppData\Local\Zottechi.exe.config => moved successfully C:\Users\Artur\AppData\Local\Avg => moved successfully C:\Users\Artur\AppData\Local\Opera Software => moved successfully C:\Users\Artur\AppData\Local\Tempfolder => moved successfully C:\Users\Artur\AppData\Local\Microsoft\Windows\GameExplorer\{6F2514B1-2D81-45FD-AFF8-55E0108B06A7} => moved successfully C:\Users\Artur\AppData\Local\Mozilla\Firefox => moved successfully C:\Users\Artur\AppData\LocalLow\Company => moved successfully C:\Users\Artur\AppData\Roaming\ex_log.txt => moved successfully C:\Users\Artur\AppData\Roaming\AVG => moved successfully C:\Users\Artur\AppData\Roaming\DivX => moved successfully C:\Users\Artur\AppData\Roaming\GoldenGate => moved successfully C:\Users\Artur\AppData\Roaming\Opera Software => moved successfully C:\Users\Artur\AppData\Roaming\WarThunder => moved successfully "C:\Users\Artur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Play Sparta - War of empires.lnk" => not found. =========== "C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\*.LNK" ========== C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\bat.LNK => moved successfully C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\Michal.LNK => moved successfully C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\OC w doc(1).LNK => moved successfully C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\oÅ›wiadczenie studenta(1).LNK => moved successfully C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\oÅ›wiadczenie studenta.LNK => moved successfully C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\o��wiadczenie studenta.LNK => moved successfully C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\Pereca skarga 2(1).docx.LNK => moved successfully C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\Pereca skarga 2.docx.LNK => moved successfully C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\Pulpit.LNK => moved successfully C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\RDS_Lider ZespoÅ‚u kwestionariusz samooceny.docx.LNK => moved successfully C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\Umowa zlecenie IT.LNK => moved successfully C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\Umowa.LNK => moved successfully C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\Zadanie przedszkoleniowe nc+ AKADEMIA nc+.docx.LNK => moved successfully ========= End -> "C:\Users\Artur\AppData\Roaming\Microsoft\Office\Niedawny\*.LNK" ======== C:\Users\Artur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DarthMod Empire.lnk => moved successfully C:\Users\Artur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DarthMod Empire => moved successfully C:\Users\Artur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Third Age - Total War 3.0 (Part 1of2) => moved successfully C:\Users\Artur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Third Age - Total War 3.0 (Part 2of2) => moved successfully C:\Users\Artur\AppData\Roaming\Mozilla\Firefox => moved successfully C:\Users\Artur\Desktop\Third Age - Total War.lnk => moved successfully C:\Users\Administrator => moved successfully C:\Users\ASPNET => moved successfully C:\Users\Guest => moved successfully C:\Users\HomeGroupUser$ => moved successfully C:\Users\UpdatusUser => moved successfully C:\Windows\system32\XesmitgeOff.ini => moved successfully C:\Windows\system32\Drivers\etc\hp.bak => moved successfully C:\Windows\System32\Tasks\Doctor Web => moved successfully C:\Windows\SysWOW64\history.dat => moved successfully C:\Windows\SysWOW64\Xesmitge.ini => moved successfully C:\Windows\SysWOW64\XesmitgeOff.ini => moved successfully ========= reg delete HKCU\Software\Mozilla\Firefox /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKCU\Software\MozillaPlugins /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Mozilla\Firefox /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\MozillaPlugins /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomy˜lnie. ========= End of Reg: ========= ========= ipconfig /flushdns ========= Konfiguracja IP systemu Windows Pomy˜lnie opr¢¾niono pami©† podr©czn¥ programu rozpoznawania nazw DNS. ========= End of CMD: ========= ========= netsh advfirewall reset ========= Ok. ========= End of CMD: ========= EmptyTemp: => 100.4 MB temporary data Removed. The system needed a reboot. ==== End of Fixlog 15:22:05 ====