Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 19-04-2015 01 Ran by Ginette at 2015-04-22 12:09:31 Run:2 Running from C:\Users\Ginette\Desktop Loaded Profiles: Ginette (Available profiles: Ginette) Boot Mode: Normal ============================================== Content of fixlist: ***************** start CreateRestorePoint: (Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-04-18] ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe (McAfee, Inc. SearchScopes: HKLM -> {9465BC86-3F40-486B-BCCA-2BB4960A2B20} URL = http://www.amazon.ca...s={searchTerms} FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Extension: saaveRneet - C:\Users\Ginette\AppData\Roaming\Mozilla\Firefox\Profiles\07ifvjb6.default\Extensions\il0@A.edu [2015-04-17] FF Extension: saVeron - C:\Users\Ginette\AppData\Roaming\Mozilla\Firefox\Profiles\07ifvjb6.default\Extensions\quUbk2qc5@9z.edu [2015-04-17] S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe [234776 2012-09-05] (McAfee, Inc.) S2 sbapifs; system32\DRIVERS\sbapifs.sys [X] 2015-04-18 16:15 - 2015-04-18 16:15 - 00002172 _____ () C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2015-04-18 16:15 - 2015-04-18 16:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2015-04-18 16:15 - 2015-04-18 16:15 - 00000000 ____D () C:\ProgramData\McAfee Security Scan 2015-04-18 16:15 - 2015-04-18 16:15 - 00000000 ____D () C:\Program Files (x86)\McAfee Security Scan 2015-04-08 21:50 - 2015-04-08 21:50 - 00000016 _____ () C:\Windows\system32\rcores64.dat.szfi 2015-04-17 22:07 - 2015-04-17 22:07 - 00003048 _____ () C:\Windows\System32\Tasks\{6A9B83D6-0134-410A-985C-8C942B26B5B7} 2015-04-19 15:26 - 2012-05-06 21:43 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-04-19 15:23 - 2012-04-11 21:35 - 00000900 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-04-19 10:00 - 2012-04-11 21:35 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-04-18 20:23 - 2011-09-24 13:18 - 00003942 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{17B00785-F858-49EC-BE83-1220FE594171} 2015-04-18 00:14 - 2011-10-13 19:45 - 00000000 ____D () C:\Users\Ginette\AppData\Roaming\uTorrent 2015-04-17 07:49 - 2015-01-05 15:09 - 00000016 _____ () C:\Windows\system32\mrt.exe.szfi 2015-04-15 11:01 - 2015-01-05 12:05 - 00000016 _____ () C:\Windows\system32\config\software.szfi CustomCLSID: HKU\S-1-5-21-3037352765-1606511786-2657095333-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Ginette\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File Task: {0426528F-B7ED-4945-BC73-1C1E75E7533A} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated) Task: {22F9A66C-2561-4478-9D56-021F9948C8EB} - System32\Tasks\{6A9B83D6-0134-410A-985C-8C942B26B5B7} => pcalua.exe -a C:\BTGUARD\Uninstal.exe Task: {6D273318-290A-45D8-8716-8EF1663EF2E4} - System32\Tasks\{BF94A88D-3190-4E85-8EB2-A7CA363C6E83} => pcalua.exe -a C:\Users\Ginette\Documents\RK_DriverAssitant\Release_DriverAssitant\DriverInstall.exe -d C:\Users\Ginette\Documents\RK_DriverAssitant\Release_DriverAssitant Task: {74A892D8-47DF-494F-A050-636813533571} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-18] (Adobe Systems Incorporated) Task: {86C2FC06-5B03-44A3-8200-B69C838471D2} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: {9AE0DE71-555F-48A1-BF33-0C2AE4039247} - System32\Tasks\{E0E0E169-16E0-44BA-BB0B-695A2B3E8B80} => pcalua.exe -a F:\setup.exe -d F:\ Task: {AFC3E0F0-0068-4618-BD6A-8EF88A77E2A3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: {BAE46588-400B-4E8B-8665-EF4822212705} - System32\Tasks\arp_flush => C:\Program Files (x86)\hide.me VPN\FlushArpCache.exe Task: {CD0CFEA5-626D-4E62-9A62-65E7E33951EF} - \{2D945EC9-D406-4CE0-9DD5-795A8A34991D} No Task File <==== ATTENTION Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: CMD: netsh advfirewall reset CMD: netsh advfirewall set allprofiles state ON CMD: ipconfig /flushdns CMD: netsh winsock reset catalog CMD: netsh int ip reset c:\resetlog.txt CMD: ipconfig /release CMD: ipconfig /renew CMD: netsh int ipv4 reset CMD: netsh int ipv6 reset Hosts: EmptyTemp: CMD: bitsadmin /reset /allusers ***************** Restore point was successfully created. [2164] C:\Program Files\File Association Helper\FAHWindow.exe => Process closed successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\FAHConsole => value deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk not found. ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe (McAfee, Inc. not found. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9465BC86-3F40-486B-BCCA-2BB4960A2B20}" => Key deleted successfully. HKCR\CLSID\{9465BC86-3F40-486B-BCCA-2BB4960A2B20} => Key not found. "HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully. C:\Users\Ginette\AppData\Roaming\Mozilla\Firefox\Profiles\07ifvjb6.default\Extensions\il0@A.edu => Moved successfully. C:\Users\Ginette\AppData\Roaming\Mozilla\Firefox\Profiles\07ifvjb6.default\Extensions\quUbk2qc5@9z.edu => Moved successfully. McComponentHostService => Service not found. sbapifs => Service deleted successfully. "C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk" => File/Directory not found. "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus" => File/Directory not found. "C:\ProgramData\McAfee Security Scan" => File/Directory not found. "C:\Program Files (x86)\McAfee Security Scan" => File/Directory not found. C:\Windows\system32\rcores64.dat.szfi => Moved successfully. C:\Windows\System32\Tasks\{6A9B83D6-0134-410A-985C-8C942B26B5B7} => Moved successfully. C:\Windows\Tasks\Adobe Flash Player Updater.job => Moved successfully. C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => Moved successfully. C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => Moved successfully. C:\Windows\System32\Tasks\User_Feed_Synchronization-{17B00785-F858-49EC-BE83-1220FE594171} => Moved successfully. C:\Users\Ginette\AppData\Roaming\uTorrent => Moved successfully. C:\Windows\system32\mrt.exe.szfi => Moved successfully. C:\Windows\system32\config\software.szfi => Moved successfully. "HKU\S-1-5-21-3037352765-1606511786-2657095333-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0426528F-B7ED-4945-BC73-1C1E75E7533A}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0426528F-B7ED-4945-BC73-1C1E75E7533A}" => Key deleted successfully. C:\Windows\System32\Tasks\Adobe Acrobat Update Task => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Adobe Acrobat Update Task" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{22F9A66C-2561-4478-9D56-021F9948C8EB}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{22F9A66C-2561-4478-9D56-021F9948C8EB}" => Key deleted successfully. C:\Windows\System32\Tasks\{6A9B83D6-0134-410A-985C-8C942B26B5B7} not found. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6A9B83D6-0134-410A-985C-8C942B26B5B7}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6D273318-290A-45D8-8716-8EF1663EF2E4}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6D273318-290A-45D8-8716-8EF1663EF2E4}" => Key deleted successfully. C:\Windows\System32\Tasks\{BF94A88D-3190-4E85-8EB2-A7CA363C6E83} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{BF94A88D-3190-4E85-8EB2-A7CA363C6E83}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{74A892D8-47DF-494F-A050-636813533571}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{74A892D8-47DF-494F-A050-636813533571}" => Key deleted successfully. C:\Windows\System32\Tasks\Adobe Flash Player Updater => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Adobe Flash Player Updater" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{86C2FC06-5B03-44A3-8200-B69C838471D2}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{86C2FC06-5B03-44A3-8200-B69C838471D2}" => Key deleted successfully. C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9AE0DE71-555F-48A1-BF33-0C2AE4039247}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9AE0DE71-555F-48A1-BF33-0C2AE4039247}" => Key deleted successfully. C:\Windows\System32\Tasks\{E0E0E169-16E0-44BA-BB0B-695A2B3E8B80} => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{E0E0E169-16E0-44BA-BB0B-695A2B3E8B80}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{AFC3E0F0-0068-4618-BD6A-8EF88A77E2A3}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AFC3E0F0-0068-4618-BD6A-8EF88A77E2A3}" => Key deleted successfully. C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BAE46588-400B-4E8B-8665-EF4822212705}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BAE46588-400B-4E8B-8665-EF4822212705}" => Key deleted successfully. C:\Windows\System32\Tasks\arp_flush => Moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\arp_flush" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CD0CFEA5-626D-4E62-9A62-65E7E33951EF}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CD0CFEA5-626D-4E62-9A62-65E7E33951EF}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{2D945EC9-D406-4CE0-9DD5-795A8A34991D}" => Key deleted successfully. C:\Windows\Tasks\Adobe Flash Player Updater.job not found. C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job not found. C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job not found. ========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f ========= The operation completed successfully. ========= End of Reg: ========= ========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f ========= The operation completed successfully. ========= End of Reg: ========= ========= RemoveProxy: ========= HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully. HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully. HKU\S-1-5-21-3037352765-1606511786-2657095333-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully. HKU\S-1-5-21-3037352765-1606511786-2657095333-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully. ========= End of RemoveProxy: ========= ========= netsh advfirewall reset ========= Ok. ========= End of CMD: ========= ========= netsh advfirewall set allprofiles state ON ========= Ok. ========= End of CMD: ========= ========= ipconfig /flushdns ========= Windows IP Configuration Successfully flushed the DNS Resolver Cache. ========= End of CMD: ========= ========= netsh winsock reset catalog ========= Sucessfully reset the Winsock Catalog. You must restart the computer in order to complete the reset. ========= End of CMD: ========= ========= netsh int ip reset c:\resetlog.txt ========= Reseting Global, OK! Reseting Interface, OK! Restart the computer to complete this action. ========= End of CMD: ========= ========= ipconfig /release ========= Windows IP Configuration No operation can be performed on Wireless Network Connection while it has its media disconnected. No operation can be performed on Local Area Connection while it has its media disconnected. ========= End of CMD: ========= ========= ipconfig /renew ========= Windows IP Configuration No operation can be performed on Wireless Network Connection while it has its media disconnected. No operation can be performed on Local Area Connection while it has its media disconnected. ========= End of CMD: ========= ========= netsh int ipv4 reset ========= There's no user specified settings to be reset. ========= End of CMD: ========= ========= netsh int ipv6 reset ========= There's no user specified settings to be reset. ========= End of CMD: ========= C:\Windows\System32\Drivers\etc\hosts => Moved successfully. Hosts was reset successfully. ========= bitsadmin /reset /allusers ========= BITSADMIN version 3.0 [ 7.5.7601 ] BITS administration utility. (C) Copyright 2000-2006 Microsoft Corp. BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows. Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets. 0 out of 0 jobs canceled. ========= End of CMD: ========= EmptyTemp: => Removed 17.5 MB temporary data. The system needed a reboot. ==== End of Fixlog 12:10:15 ====