Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Fix result of Farbar Recovery Scan Tool (x86) Version:17-04-2016
- Ran by DEPP (2016-04-18 10:07:23) Run:1
- Running from C:\Users\DEPP\Desktop
- Loaded Profiles: DEPP (Available Profiles: DEPP)
- Boot Mode: Normal
- ==============================================
- fixlist content:
- *****************
- start
- CloseProcesses:
- HKU\S-1-5-21-563482115-3036595567-2997201845-1001\...\RunOnce: [Microsoft Corporation WddbIKiPaDSUGKHd] => C:\Users\DEPP\AppData\Roaming\WddbIKiPaDSUGKHd.exe [1595392 2016-04-18] ()
- GroupPolicy: Restriction - Chrome <======= ATTENTION
- GroupPolicyScripts: Restriction <======= ATTENTION
- GroupPolicyScripts\User: Restriction <======= ATTENTION
- CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
- CHR HKU\S-1-5-21-563482115-3036595567-2997201845-1001\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
- Toolbar: HKU\S-1-5-21-563482115-3036595567-2997201845-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
- BHO: No Name -> {C35B7206-62EB-F808-5475-18A6FDE7DD94} -> No File
- SearchScopes: HKLM -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfQwKUV1JEAYTbQFdWV9cFQAbdRRaVFtJDFFBIQ5dUF0QQw0WJh9aFQQTSEc?FME0FCFwEURNNfX1REloeV1BROXhIEQ==&q={searchTerms}
- SearchScopes: HKLM -> OldSearch URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
- SearchScopes: HKLM -> {6586d803-df30-46d3-a89a-4136c8571d45} URL = hxxp://www.palikan.com/results.php?f=4&a=bfp_coinisre_16_09&cd=2XzuyEtN2Y1L1Qzu0AtD0FtA0CtC0CyEtCtBtBtCtDzy0EyEtN0D0Tzu0StCyDtByEtN1L2Xz?utAtFtCzztFtCtFyDtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StByD0A0CyC0DtAtBtGtBtDtA0BtG0?B0Fzy0DtGtBtDzy0FtGtBtCzz0CtByE0DtDyD0B0CtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AzytDtByD0?CtD0FtGtA0D0CzztGyEtAzytDtG0ByBtDyDtG0A0CyB0F0CyC0AyB0F0CtDyB2QtN0A0LzutB&cr=343473937&ir=&q={searchTerms}
- SearchScopes: HKLM -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfQwKUV1JEAYTbQFdWV9cFQAbdRRaVFtJDFFBIQ5dUF0QQw0WJh9aFQQTSEc?FME0FCFwEURNNfX1REloeV1BROXhIEQ==&q={searchTerms}
- SearchScopes: HKU\S-1-5-21-563482115-3036595567-2997201845-1001 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfQwKUV1JEAYTbQFdWV9cFQAbdRRaVFtJDFFBIQ5dUF0QQw0WJh9aFQQTSEc?FME0FCFwEURNNfX1REloeV1BROXhIEQ==&q={searchTerms}
- SearchScopes: HKU\S-1-5-21-563482115-3036595567-2997201845-1001 -> OldSearch URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
- SearchScopes: HKU\S-1-5-21-563482115-3036595567-2997201845-1001 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.delta-search.com/?q={searchTerms}&affID=121631&babsrc=SP_ss&mntrId=D07C002522987BAD
- SearchScopes: HKU\S-1-5-21-563482115-3036595567-2997201845-1001 -> {2802DE9B-C921-45D8-B15E-2F5CFEEB6301} URL = hxxps://ph.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=830633&p={searchTerms}
- SearchScopes: HKU\S-1-5-21-563482115-3036595567-2997201845-1001 -> {6586d803-df30-46d3-a89a-4136c8571d45} URL = hxxp://www.palikan.com/results.php?f=4&a=bfp_coinisre_16_09&cd=2XzuyEtN2Y1L1Qzu0AtD0FtA0CtC0CyEtCtBtBtCtDzy0EyEtN0D0Tzu0StCyDtByEtN1L2Xz?utAtFtCzztFtCtFyDtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StByD0A0CyC0DtAtBtGtBtDtA0BtG0?B0Fzy0DtGtBtDzy0FtGtBtCzz0CtByE0DtDyD0B0CtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AzytDtByD0?CtD0FtGtA0D0CzztGyEtAzytDtG0ByBtDyDtG0A0CyB0F0CyC0AyB0F0CtDyB2QtN0A0LzutB&cr=343473937&ir=&q={searchTerms}
- SearchScopes: HKU\S-1-5-21-563482115-3036595567-2997201845-1001 -> {883A7FD9-E6BB-481F-A75D-8ABA018A7BB5} URL = hxxp://www.mysearchresults.com/search?c=2402&t=15&q={searchTerms}
- SearchScopes: HKU\S-1-5-21-563482115-3036595567-2997201845-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfQwKUV1JEAYTbQFdWV9cFQAbdRRaVFtJDFFBIQ5dUF0QQw0WJh9aFQQTSEc?FME0FCFwEURNNfX1REloeV1BROXhIEQ==&q={searchTerms}
- BHO: No Name -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> No File
- HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRggWcglcWQhCERgbJQFeTA1EGQAOIgxaWRQVQ1QUJQhcAFtJFFMFIk0FA1ADB0V?XfVBdFElXTwhnKUpbDk8UU0xiMEk=
- HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
- HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
- HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
- HKU\S-1-5-21-563482115-3036595567-2997201845-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
- FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
- FF user.js: detected! => C:\Users\DEPP\AppData\Roaming\Mozilla\Firefox\Profiles\9ee226kc.default\user.js? [2016-01-10]
- FF HKU\S-1-5-21-563482115-3036595567-2997201845-1001\...\Firefox\Extensions: [[email protected]] - C:\Users\DEPP\AppData\Roaming\IDM\idmmzcc5 => not found
- FF HKU\S-1-5-21-563482115-3036595567-2997201845-1001\...\SeaMonkey\Extensions: [[email protected]] - C:\Users\DEPP\AppData\Roaming\IDM\idmmzcc5 => not found
- C:\Users\DEPP\AppData\Roaming\WddbIKiPaDSUGKHd.exe
- C:\ProgramData\085d0e68c7b0c248384148018c7afe1bc9b2a42d
- CustomCLSID: HKU\S-1-5-21-563482115-3036595567-2997201845-1001_Classes\CLSID\{F5DF8D65-559D-4b75-8562-5302BD2F5F20}\InprocServer32 -> C:\Users\DEPP\AppData\Roaming\2XClient\TuxClientSystem.dll => No File
- CustomCLSID: HKU\S-1-5-21-563482115-3036595567-2997201845-1001_Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}\localserver32 -> C:\Users\DEPP\AppData\Local\Chromium\Application\46.0.2472.0\delegate_execute.ex?e (The Chromium Authors) <==== ATTENTION
- CustomCLSID: HKU\S-1-5-21-563482115-3036595567-2997201845-1001_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\DEPP\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll (Facebook Inc.)
- CustomCLSID: HKU\S-1-5-21-563482115-3036595567-2997201845-1001_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\DEPP\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
- Task: {CE65177F-2C1E-418B-82A0-A70336985643} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-563482115-3036595567-2997201845-1001Core => C:\Users\DEPP\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-04-30] (Facebook Inc.)
- Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-563482115-3036595567-2997201845-1001Core.job => C:\Users\DEPP\AppData\Local\Facebook\Update\FacebookUpdate.exe
- Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-563482115-3036595567-2997201845-1001UA.job => C:\Users\DEPP\AppData\Local\Facebook\Update\FacebookUpdate.exe
- FirewallRules: [TCP Query User{E2F3C37A-3294-4204-8FFB-66B132298E2A}C:\users\depp\desktop\dark-comet v5.3\dark-comet v5.3\darkcomet.exe] => (Allow) C:\users\depp\desktop\dark-comet v5.3\dark-comet v5.3\darkcomet.exe
- FirewallRules: [UDP Query User{1E0487C9-09E5-457E-AC68-1E434AA5049C}C:\users\depp\desktop\dark-comet v5.3\dark-comet v5.3\darkcomet.exe] => (Allow) C:\users\depp\desktop\dark-comet v5.3\dark-comet v5.3\darkcomet.exe
- FirewallRules: [{FA974AEF-3545-4308-8175-F64ACE4E507E}] => (Allow) C:\Users\DEPP\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe
- FirewallRules: [TCP Query User{B46E5783-6207-4B14-BE71-D2C22E449D22}C:\users\depp\appdata\local\temp\7zo938a.tmp\listen.exe] => (Allow) C:\users\depp\appdata\local\temp\7zo938a.tmp\listen.exe
- FirewallRules: [UDP Query User{331CD783-A727-4B54-959F-E6380D79C2CC}C:\users\depp\appdata\local\temp\7zo938a.tmp\listen.exe] => (Allow) C:\users\depp\appdata\local\temp\7zo938a.tmp\listen.exe
- FirewallRules: [TCP Query User{BD5A401C-81E9-4D99-9A01-F20C6D4ACF21}C:\users\depp\desktop\pack\luminosity.exe] => (Allow) C:\users\depp\desktop\pack\luminosity.exe
- FirewallRules: [UDP Query User{F1E0593D-3610-424A-BA99-B8A293A1E6A1}C:\users\depp\desktop\pack\luminosity.exe] => (Allow) C:\users\depp\desktop\pack\luminosity.exe
- FirewallRules: [TCP Query User{94876418-B8BC-406C-A1DE-5CF824906208}C:\users\depp\desktop\p\luminosity.exe] => (Allow) C:\users\depp\desktop\p\luminosity.exe
- FirewallRules: [UDP Query User{4274D4BC-BF87-4042-A15A-DD35A5FB9F73}C:\users\depp\desktop\p\luminosity.exe] => (Allow) C:\users\depp\desktop\p\luminosity.exe
- FirewallRules: [{2F1D295E-630E-493A-A8E5-115E7D347806}] => (Allow) LPort=3547
- EmptyTemp:
- Hosts:
- *****************
- Processes closed successfully.
- HKU\S-1-5-21-563482115-3036595567-2997201845-1001\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Microsoft Corporation WddbIKiPaDSUGKHd => value removed successfully.
- C:\Windows\system32\GroupPolicy\Machine => moved successfully
- C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
- "C:\Windows\system32\GroupPolicy\Machine" => not found.
- C:\Windows\system32\GroupPolicy\User => moved successfully
- "HKLM\SOFTWARE\Policies\Google" => key removed successfully.
- "HKU\S-1-5-21-563482115-3036595567-2997201845-1001\SOFTWARE\Policies\Google" => key removed successfully.
- HKU\S-1-5-21-563482115-3036595567-2997201845-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value removed successfully.
- HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => key not found.
- "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C35B7206-62EB-F808-5475-18A6FDE7DD94}" => key removed successfully.
- HKCR\CLSID\{C35B7206-62EB-F808-5475-18A6FDE7DD94} => key not found.
- HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
- "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\OldSearch" => key removed successfully.
- HKCR\CLSID\OldSearch => key not found.
- "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6586d803-df30-46d3-a89a-4136c8571d45}" => key removed successfully.
- HKCR\CLSID\{6586d803-df30-46d3-a89a-4136c8571d45} => key not found.
- "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}" => key removed successfully.
- HKCR\CLSID\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F} => key not found.
- HKU\S-1-5-21-563482115-3036595567-2997201845-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully.
- "HKU\S-1-5-21-563482115-3036595567-2997201845-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\OldSearch" => key removed successfully.
- HKCR\CLSID\OldSearch => key not found.
- "HKU\S-1-5-21-563482115-3036595567-2997201845-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}" => key removed successfully.
- HKCR\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => key not found.
- "HKU\S-1-5-21-563482115-3036595567-2997201845-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2802DE9B-C921-45D8-B15E-2F5CFEEB6301}" => key removed successfully.
- HKCR\CLSID\{2802DE9B-C921-45D8-B15E-2F5CFEEB6301} => key not found.
- "HKU\S-1-5-21-563482115-3036595567-2997201845-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6586d803-df30-46d3-a89a-4136c8571d45}" => key removed successfully.
- HKCR\CLSID\{6586d803-df30-46d3-a89a-4136c8571d45} => key not found.
- "HKU\S-1-5-21-563482115-3036595567-2997201845-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{883A7FD9-E6BB-481F-A75D-8ABA018A7BB5}" => key removed successfully.
- HKCR\CLSID\{883A7FD9-E6BB-481F-A75D-8ABA018A7BB5} => key not found.
- "HKU\S-1-5-21-563482115-3036595567-2997201845-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}" => key removed successfully.
- HKCR\CLSID\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F} => key not found.
- "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}" => key removed successfully.
- HKCR\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8} => key not found.
- HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
- HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully
- HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
- HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
- HKU\S-1-5-21-563482115-3036595567-2997201845-1001\Software\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully
- "HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => key removed successfully.
- Could not move "C:\Users\DEPP\AppData\Roaming\Mozilla\Firefox\Profiles\9ee226kc.default\user.js?" => Scheduled to move on reboot.
- HKU\S-1-5-21-563482115-3036595567-2997201845-1001\Software\Mozilla\Firefox\Extensions\\[email protected] => value removed successfully.
- HKU\S-1-5-21-563482115-3036595567-2997201845-1001\Software\Mozilla\SeaMonkey\Extensions\\[email protected] => value removed successfully.
- C:\Users\DEPP\AppData\Roaming\WddbIKiPaDSUGKHd.exe => moved successfully
- C:\ProgramData\085d0e68c7b0c248384148018c7afe1bc9b2a42d => moved successfully
- "HKU\S-1-5-21-563482115-3036595567-2997201845-1001_Classes\CLSID\{F5DF8D65-559D-4b75-8562-5302BD2F5F20}" => key removed successfully.
- "HKU\S-1-5-21-563482115-3036595567-2997201845-1001_Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}" => key removed successfully.
- "HKU\S-1-5-21-563482115-3036595567-2997201845-1001_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}" => key removed successfully.
- "HKU\S-1-5-21-563482115-3036595567-2997201845-1001_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}" => key removed successfully.
- "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CE65177F-2C1E-418B-82A0-A70336985643}" => key removed successfully.
- "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CE65177F-2C1E-418B-82A0-A70336985643}" => key removed successfully.
- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-563482115-3036595567-2997201845-1001Core => moved successfully
- "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\FacebookUpdateTaskUserS-1-5-21-563482115-3036595567-2997201845-1001Core" => key removed successfully.
- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-563482115-3036595567-2997201845-1001Core.job => moved successfully
- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-563482115-3036595567-2997201845-1001UA.job => moved successfully
- HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{E2F3C37A-3294-4204-8FFB-66B132298E2A}C:\users\depp\desktop\dark-comet v5.3\dark-comet v5.3\darkcomet.exe => value removed successfully.
- HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{1E0487C9-09E5-457E-AC68-1E434AA5049C}C:\users\depp\desktop\dark-comet v5.3\dark-comet v5.3\darkcomet.exe => value removed successfully.
- HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{FA974AEF-3545-4308-8175-F64ACE4E507E} => value removed successfully.
- HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{B46E5783-6207-4B14-BE71-D2C22E449D22}C:\users\depp\appdata\local\temp\7zo938a.tmp\listen.exe => value removed successfully.
- HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{331CD783-A727-4B54-959F-E6380D79C2CC}C:\users\depp\appdata\local\temp\7zo938a.tmp\listen.exe => value removed successfully.
- HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{BD5A401C-81E9-4D99-9A01-F20C6D4ACF21}C:\users\depp\desktop\pack\luminosity.exe => value removed successfully.
- HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{F1E0593D-3610-424A-BA99-B8A293A1E6A1}C:\users\depp\desktop\pack\luminosity.exe => value removed successfully.
- HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{94876418-B8BC-406C-A1DE-5CF824906208}C:\users\depp\desktop\p\luminosity.exe => value removed successfully.
- HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{4274D4BC-BF87-4042-A15A-DD35A5FB9F73}C:\users\depp\desktop\p\luminosity.exe => value removed successfully.
- HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{2F1D295E-630E-493A-A8E5-115E7D347806} => value removed successfully.
- C:\Windows\System32\Drivers\etc\hosts => moved successfully
- Hosts restored successfully.
- EmptyTemp: => 11.9 GB temporary data Removed.
- Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2016-04-18 10:17:14)
- "C:\Users\DEPP\AppData\Roaming\Mozilla\Firefox\Profiles\9ee226kc.default\user.js?" => Could not move
- ==== End of Fixlog 10:17:15 ====
Advertisement
Add Comment
Please, Sign In to add comment