Fix result of Farbar Recovery Scan Tool (x86) Version:23-08-2015 Ran by Administrator (2015-08-24 19:11:02) Run:1 Running from C:\Documents and Settings\Administrator\Moje dokumenty\Pobrane Loaded Profiles: Administrator (Available Profiles: Administrator) Boot Mode: Normal ============================================== fixlist content: ***************** C:\Documents and Settings\All Users\Dane aplikacji\tWinManProt C:\Program Files\WordAnchor_1.10.0.19 Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f CHR HKU\S-1-5-21-1644491937-926492609-725345543-500\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver" HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-1644491937-926492609-725345543-500\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mystartsearch.com/?type=hp&t ... XX5SX1L74F HKU\S-1-5-21-1644491937-926492609-725345543-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mystartsearch.com/?type=hp&t ... XX5SX1L74F HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type= ... SX1L74F&q={searchTerms} SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type= ... SX1L74F&q={searchTerms} SearchScopes: HKU\S-1-5-21-1644491937-926492609-725345543-500 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type= ... SX1L74F&q={searchTerms} SearchScopes: HKU\S-1-5-21-1644491937-926492609-725345543-500 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.istartsurf.com/web/?utm_sour ... default&q={searchTerms} SearchScopes: HKU\S-1-5-21-1644491937-926492609-725345543-500 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.istartsurf.com/web/?utm_sour ... default&q={searchTerms} SearchScopes: HKU\S-1-5-21-1644491937-926492609-725345543-500 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type= ... SX1L74F&q={searchTerms} SearchScopes: HKU\S-1-5-21-1644491937-926492609-725345543-500 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.istartsurf.com/web/?utm_sour ... default&q={searchTerms} SearchScopes: HKU\S-1-5-21-1644491937-926492609-725345543-500 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.istartsurf.com/web/?utm_sour ... default&q={searchTerms} SearchScopes: HKU\S-1-5-21-1644491937-926492609-725345543-500 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.istartsurf.com/web/?utm_sour ... default&q={searchTerms} FF NewTab: chrome://quick_start/content/index.html FF DefaultSearchEngine: mystartsearch FF SearchPlugin: C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\z408no9f.default-1432292210031\searchplugins\mystartsearch.xml [2015-08-24] FF Extension: Default SearchProtected - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\z408no9f.default-1432292210031\Extensions\defsearchp@gmail.com [2015-08-16] FF Extension: deskCut - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\z408no9f.default-1432292210031\Extensions\deskCutv2@gmail.com [2015-08-16] FF HKLM\...\Firefox\Extensions: [searchffv2@gmail.com] - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\z408no9f.default-1432292210031\extensions\searchffv2@gmail.com FF HKLM\...\Firefox\Extensions: [sweetsearch@gmail.com] - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\z408no9f.default-1432292210031\extensions\sweetsearch@gmail.com FF HKLM\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\z408no9f.default-1432292210031\extensions\defsearchp@gmail.com FF HKLM\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\z408no9f.default-1432292210031\extensions\deskCutv2@gmail.com R2 WindowsMangerProtect; C:\Documents and Settings\All Users\Dane aplikacji\tWinManProt\ProtectWindowsManager.exe [708264 2015-08-16] (DTools LIMITED) <==== ATTENTION R1 wafd_1_10_0_19; C:\WINDOWS\System32\drivers\wafd_1_10_0_19.sys [56448 2015-06-16] (WA) S3 catchme; \??\C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\catchme.sys [X] S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X] S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X] S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X] S3 huawei_cdcecm; system32\DRIVERS\ew_jucdcecm.sys [X] S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X] S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X] C:\Program Files\Mozilla Firefoxavg-secure-search.xml EmptyTemp: ***************** C:\Documents and Settings\All Users\Dane aplikacji\tWinManProt => moved successfully "C:\Program Files\WordAnchor_1.10.0.19" => File/Folder not found. ========= reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Błąd: system nie może odnaleźć określonego klucza rejestru lub wartości. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukończona pomyślnie ========= End of Reg: ========= "HKU\S-1-5-21-1644491937-926492609-725345543-500\SOFTWARE\Policies\Google" => key removed successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart" => key removed successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys" => key removed successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys" => key removed successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart" => key removed successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys" => key removed successfully. "HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys" => key removed successfully. HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => key not found. "HKU\S-1-5-21-1644491937-926492609-725345543-500\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKU\S-1-5-21-1644491937-926492609-725345543-500\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\\Tabs => value restored successfully HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => key not found. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => key not found. HKU\S-1-5-21-1644491937-926492609-725345543-500\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully. HKU\S-1-5-21-1644491937-926492609-725345543-500\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. "HKU\S-1-5-21-1644491937-926492609-725345543-500\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}" => key removed successfully. HKCR\CLSID\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} => key not found. HKU\S-1-5-21-1644491937-926492609-725345543-500\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => key not found. HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => key not found. HKU\S-1-5-21-1644491937-926492609-725345543-500\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{632F07F3-19A1-4d16-A23F-E6CE9486BAB5} => key not found. HKCR\CLSID\{632F07F3-19A1-4d16-A23F-E6CE9486BAB5} => key not found. "HKU\S-1-5-21-1644491937-926492609-725345543-500\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => key removed successfully. HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => key not found. "HKU\S-1-5-21-1644491937-926492609-725345543-500\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}" => key removed successfully. HKCR\CLSID\{E733165D-CBCF-4FDA-883E-ADEF965B476C} => key not found. Firefox "newtab" removed successfully. Firefox DefaultSearchEngine removed successfully. "C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\z408no9f.default-1432292210031\searchplugins\mystartsearch.xml" => not found. C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\z408no9f.default-1432292210031\Extensions\defsearchp@gmail.com => not found. C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\z408no9f.default-1432292210031\Extensions\deskCutv2@gmail.com => not found. HKLM\Software\Mozilla\Firefox\Extensions\\searchffv2@gmail.com => value not found. HKLM\Software\Mozilla\Firefox\Extensions\\sweetsearch@gmail.com => value not found. HKLM\Software\Mozilla\Firefox\Extensions\\defsearchp@gmail.com => value not found. HKLM\Software\Mozilla\Firefox\Extensions\\deskCutv2@gmail.com => value not found. WindowsMangerProtect => service not found. wafd_1_10_0_19 => service not found. catchme => service removed successfully. ew_hwusbdev => service removed successfully. ew_usbenumfilter => service removed successfully. huawei_cdcacm => service removed successfully. huawei_cdcecm => service removed successfully. huawei_enumerator => service removed successfully. huawei_ext_ctrl => service removed successfully. C:\Program Files\Mozilla Firefoxavg-secure-search.xml => moved successfully EmptyTemp: => 114.6 MB temporary data Removed. The system needed a reboot. ==== End of Fixlog 19:11:18 ====