Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-09-2013 Ran by SYSTEM at 2013-09-07 05:38:17 Run:1 Running from F:\ Boot Mode: Recovery ============================================== Content of fixlist: ***************** HKLM\...\Winlogon: [Shell] [0 ] () <=== ATTENTION HKLM-x32\...\Winlogon: [Shell] [0 ] () <=== ATTENTION HKLM-x32\...\Winlogon: [Shell] [0 ] () <=== ATTENTION HKLM\...\InprocServer32: [Default-wbemess] ATTENTION! ====> ZeroAccess? HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess? ZeroAccess: C:\Users\Cunningham\AppData\Local\Google\Desktop\Install\{806c3a61-a563-2436-6e78-f28c5e7520e1} ZeroAccess: C:\Program Files (x86)\Google\Desktop\Install\{806c3a61-a563-2436-6e78-f28c5e7520e1} C:\Users\Cunningham\AppData\Roaming\cache.ini DeleteJunctionsIndirectory: C:\Program Files\Windows Defender DeleteJunctionsIndirectory: C:\Program Files\Microsoft Security Client HKLM\...\.exe: <===== ATTENTION! HKLM\...\exefile\DefaultIcon: <===== ATTENTION! HKLM\...\exefile\open\command: <===== ATTENTION! ***************** HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value was restored successfully. HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value was restored successfully. HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value was restored successfully. HKLM\Software\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32\\Default => Value was restored successfully. HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully. C:\Users\Cunningham\AppData\Local\Google\Desktop\Install\{806c3a61-a563-2436-6e78-f28c5e7520e1} => Moved successfully. C:\Program Files (x86)\Google\Desktop\Install\{806c3a61-a563-2436-6e78-f28c5e7520e1} => Moved successfully. C:\Users\Cunningham\AppData\Roaming\cache.ini => Moved successfully. Error: DeleteJunctionsIndirectory: C:\Program Files\Windows Defender => entry should be fixed outside recovery mode. Error: DeleteJunctionsIndirectory: C:\Program Files\Microsoft Security Client => entry should be fixed outside recovery mode. HKLM\Software\Classes\.exe\\Default => Value was restored successfully. HKLM\Software\Classes\exefile\DefaultIcon\\Default => Value was restored successfully. HKLM\Software\Classes\exefile\shell\open\command\\Default => Value was restored successfully. ==== End of Fixlog ====