Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 20-11-2014 Ran by Pettit Family at 2014-11-21 10:07:06 Run:2 Running from C:\Users\Pettit Family\Downloads Loaded Profile: Pettit Family (Available profiles: Pettit Family & Elli) Boot Mode: Normal ============================================== Content of fixlist: ***************** GroupPolicyUsers\S-1-5-21-1737900368-1643728146-1281706836-1005\User: Group Policy restriction detected <======= ATTENTION HKU\S-1-5-21-1737900368-1643728146-1281706836-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://lty.s.upromise.com/member/home URLSearchHook: HKU\S-1-5-21-1737900368-1643728146-1281706836-1001 - Default Value = (value not set) URLSearchHook: HKU\S-1-5-21-1737900368-1643728146-1281706836-1001 - FCToolbarURLSearchHook Class - {6f52f077-2dbf-f864-8da7-73cc1a21005a} - C:\Program Files\Upromise RewardU Toolbar\Helper.dll () URLSearchHook: HKU\S-1-5-21-1737900368-1643728146-1281706836-1001 - FCToolbarURLSearchHook Class - {6f52f077-2dbf-f864-8da7-73cc1a21005a} - C:\Program Files (x86)\Upromise RewardU Toolbar\Helper.dll () HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION SearchScopes: HKLM-x32 -> DefaultScope value is missing. SearchScopes: HKU\S-1-5-21-1737900368-1643728146-1281706836-1001 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = SearchScopes: HKU\S-1-5-21-1737900368-1643728146-1281706836-1001 -> {b167b83b-348e-4f8a-a00d-693f28ede787} URL = http://search.expats...q={searchTerms} BHO: Upromise RewardU Toolbar BHO -> {2E1946E4-D51E-6074-C16F-ED7E0D98A8E4} -> C:\Program Files\Upromise RewardU Toolbar\Upromise RewardU Toolbar.dll (Freecause Inc.) BHO-x32: Upromise RewardU Toolbar BHO -> {2E1946E4-D51E-6074-C16F-ED7E0D98A8E4} -> C:\Program Files (x86)\Upromise RewardU Toolbar\Upromise RewardU Toolbar.dll (Freecause Inc.) Toolbar: HKLM - Upromise RewardU Toolbar - {BCB2559D-DE26-E8F4-D552-AE05CE2BAC69} - C:\Program Files\Upromise RewardU Toolbar\Upromise RewardU Toolbar.dll (Freecause Inc.) Toolbar: HKLM-x32 - Upromise RewardU Toolbar - {BCB2559D-DE26-E8F4-D552-AE05CE2BAC69} - C:\Program Files (x86)\Upromise RewardU Toolbar\Upromise RewardU Toolbar.dll (Freecause Inc.) Toolbar: HKU\S-1-5-21-1737900368-1643728146-1281706836-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Toolbar: HKU\S-1-5-21-1737900368-1643728146-1281706836-1001 -> Upromise RewardU Toolbar - {BCB2559D-DE26-E8F4-D552-AE05CE2BAC69} - C:\Program Files\Upromise RewardU Toolbar\Upromise RewardU Toolbar.dll (Freecause Inc.) DPF: HKLM-x32 {6A060448-60F9-11D5-A6CD-0002B31F7455} FF Homepage: hxxp://shop.upromise.com/?ax=toolbar_rewardu FF Extension: Upromise RewardU Toolbar - C:\Users\Pettit Family\AppData\Roaming\Mozilla\Firefox\Profiles\9m16m6x0.default-1400773569444\Extensions\{b9871413-95b7-01c4-69cf-961a01420158}.xpi [2014-06-15] CHR Extension: (Upromise RewardU Toolbar) - C:\Users\Pettit Family\AppData\Local\Google\Chrome\User Data\Default\Extensions\ddpocmpoechljihmgemoaahhmadaenbc [2014-04-23] 2014-11-21 08:51 - 2014-11-21 08:51 - 00000000 ____D () C:\Users\Pettit Family\AppData\Local\{09877100-8235-4FEC-B4AC-F79FE9A25CD5} 2014-11-21 06:34 - 2014-11-21 06:34 - 00000512 _____ () C:\Windows\system32\F39D4DE6-98B8-4E05-91BD-549E8A8248BD 2014-11-19 20:27 - 2014-11-20 20:51 - 00000000 ____D () C:\Users\Pettit Family\AppData\Local\{46814C06-F78E-4660-8EDD-FA89EADB2F92} 2014-11-12 11:40 - 2014-11-16 14:40 - 00000000 ____D () C:\Users\Pettit Family\AppData\Local\{3937FB55-3321-4324-88BB-D0BAF19DB224} 2014-11-08 08:49 - 2014-11-11 21:46 - 00000000 ____D () C:\Users\Pettit Family\AppData\Local\{31E68712-7304-4D01-AD7A-0CD2B1A052F4} 2014-11-07 18:45 - 2014-11-07 18:45 - 00000000 ____D () C:\Users\Pettit Family\AppData\Local\{6FFF6EC0-ADDC-448D-8CAA-6907CE39B152} 2014-11-05 18:18 - 2014-11-07 06:45 - 00000000 ____D () C:\Users\Pettit Family\AppData\Local\{117DE877-BE57-4F0F-A159-24867A1A6F2A} 2014-11-04 08:41 - 2014-11-05 06:18 - 00000000 ____D () C:\Users\Pettit Family\AppData\Local\{40AB7A1F-060B-4EEE-8B50-0DFBB889C3FA} 2014-11-03 08:40 - 2014-11-03 20:41 - 00000000 ____D () C:\Users\Pettit Family\AppData\Local\{94916300-4643-4C30-85A6-B9D89E05961A} 2014-10-31 06:42 - 2014-11-02 20:39 - 00000000 ____D () C:\Users\Pettit Family\AppData\Local\{FCF44389-2950-477A-9649-308191A3FD4A} 2014-10-29 18:14 - 2014-10-31 06:37 - 00000000 ____D () C:\Program Files (x86)\Upromise RewardU Toolbar 2014-10-29 18:14 - 2014-10-30 18:14 - 00000000 ____D () C:\Users\Pettit Family\AppData\Local\{4BB0E421-CEC3-48EE-8081-1B20B1673133} 2014-10-29 18:14 - 2014-10-29 18:14 - 00000000 ____D () C:\Users\Pettit Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Upromise RewardU Toolbar 2014-10-29 18:14 - 2014-10-29 18:14 - 00000000 ____D () C:\Program Files\Upromise RewardU Toolbar 2014-10-29 06:13 - 2014-10-29 06:13 - 00000000 ____D () C:\Users\Pettit Family\AppData\Local\{EF333805-16F7-4E1B-960A-9F18DA9DE81F} 2014-10-24 21:46 - 2014-10-28 08:13 - 00000000 ____D () C:\Users\Pettit Family\AppData\Local\{149EC0FF-FC09-497D-A692-3B77549C0B7B} EmptyTemp: CMD: bitsadmin /reset /allusers ***************** C:\Windows\system32\GroupPolicyUsers\S-1-5-21-1737900368-1643728146-1281706836-1005\User => Moved successfully. C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully. HKU\S-1-5-21-1737900368-1643728146-1281706836-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKU\S-1-5-21-1737900368-1643728146-1281706836-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\ => value deleted successfully. HKU\S-1-5-21-1737900368-1643728146-1281706836-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{6f52f077-2dbf-f864-8da7-73cc1a21005a} => value deleted successfully. "HKCR\CLSID\{6f52f077-2dbf-f864-8da7-73cc1a21005a}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{6f52f077-2dbf-f864-8da7-73cc1a21005a}" => Key deleted successfully. HKU\S-1-5-21-1737900368-1643728146-1281706836-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{6f52f077-2dbf-f864-8da7-73cc1a21005a} => Value not found. "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. "HKU\S-1-5-21-1737900368-1643728146-1281706836-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}" => Key deleted successfully. "HKCR\CLSID\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}" => Key not found. "HKU\S-1-5-21-1737900368-1643728146-1281706836-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{b167b83b-348e-4f8a-a00d-693f28ede787}" => Key deleted successfully. "HKCR\CLSID\{b167b83b-348e-4f8a-a00d-693f28ede787}" => Key not found. "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2E1946E4-D51E-6074-C16F-ED7E0D98A8E4}" => Key deleted successfully. "HKCR\CLSID\{2E1946E4-D51E-6074-C16F-ED7E0D98A8E4}" => Key deleted successfully. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2E1946E4-D51E-6074-C16F-ED7E0D98A8E4}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{2E1946E4-D51E-6074-C16F-ED7E0D98A8E4}" => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{BCB2559D-DE26-E8F4-D552-AE05CE2BAC69} => value deleted successfully. "HKCR\CLSID\{BCB2559D-DE26-E8F4-D552-AE05CE2BAC69}" => Key deleted successfully. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{BCB2559D-DE26-E8F4-D552-AE05CE2BAC69} => value deleted successfully. "HKCR\Wow6432Node\CLSID\{BCB2559D-DE26-E8F4-D552-AE05CE2BAC69}" => Key deleted successfully. HKU\S-1-5-21-1737900368-1643728146-1281706836-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value deleted successfully. "HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" => Key not found. HKU\S-1-5-21-1737900368-1643728146-1281706836-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BCB2559D-DE26-E8F4-D552-AE05CE2BAC69} => value deleted successfully. "HKCR\CLSID\{BCB2559D-DE26-E8F4-D552-AE05CE2BAC69}" => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Code Store Database\Distribution Units\{6A060448-60F9-11D5-A6CD-0002B31F7455}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{6A060448-60F9-11D5-A6CD-0002B31F7455}" => Key deleted successfully. Firefox homepage deleted successfully. C:\Users\Pettit Family\AppData\Roaming\Mozilla\Firefox\Profiles\9m16m6x0.default-1400773569444\Extensions\{b9871413-95b7-01c4-69cf-961a01420158}.xpi => Moved successfully. C:\Users\Pettit Family\AppData\Local\Google\Chrome\User Data\Default\Extensions\ddpocmpoechljihmgemoaahhmadaenbc => Moved successfully. C:\Users\Pettit Family\AppData\Local\{09877100-8235-4FEC-B4AC-F79FE9A25CD5} => Moved successfully. C:\Windows\system32\F39D4DE6-98B8-4E05-91BD-549E8A8248BD => Moved successfully. C:\Users\Pettit Family\AppData\Local\{46814C06-F78E-4660-8EDD-FA89EADB2F92} => Moved successfully. C:\Users\Pettit Family\AppData\Local\{3937FB55-3321-4324-88BB-D0BAF19DB224} => Moved successfully. C:\Users\Pettit Family\AppData\Local\{31E68712-7304-4D01-AD7A-0CD2B1A052F4} => Moved successfully. C:\Users\Pettit Family\AppData\Local\{6FFF6EC0-ADDC-448D-8CAA-6907CE39B152} => Moved successfully. C:\Users\Pettit Family\AppData\Local\{117DE877-BE57-4F0F-A159-24867A1A6F2A} => Moved successfully. C:\Users\Pettit Family\AppData\Local\{40AB7A1F-060B-4EEE-8B50-0DFBB889C3FA} => Moved successfully. C:\Users\Pettit Family\AppData\Local\{94916300-4643-4C30-85A6-B9D89E05961A} => Moved successfully. C:\Users\Pettit Family\AppData\Local\{FCF44389-2950-477A-9649-308191A3FD4A} => Moved successfully. C:\Program Files (x86)\Upromise RewardU Toolbar => Moved successfully. C:\Users\Pettit Family\AppData\Local\{4BB0E421-CEC3-48EE-8081-1B20B1673133} => Moved successfully. C:\Users\Pettit Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Upromise RewardU Toolbar => Moved successfully. C:\Program Files\Upromise RewardU Toolbar => Moved successfully. C:\Users\Pettit Family\AppData\Local\{EF333805-16F7-4E1B-960A-9F18DA9DE81F} => Moved successfully. C:\Users\Pettit Family\AppData\Local\{149EC0FF-FC09-497D-A692-3B77549C0B7B} => Moved successfully. ========= bitsadmin /reset /allusers ========= BITSADMIN version 3.0 [ 7.5.7601 ] BITS administration utility. (C) Copyright 2000-2006 Microsoft Corp. BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows. Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets. {7428A0F7-EB8A-4FF1-9848-FD511E7063D4} canceled. 1 out of 1 jobs canceled. ========= End of CMD: ========= EmptyTemp: => Removed 647.3 MB temporary data. The system needed a reboot. ==== End of Fixlog ====