Fix result of Farbar Recovery Scan Tool (x64) Version:27-01-2016 Ran by NorthP (2016-01-30 15:55:52) Run:1 Running from C:\Users\NorthP\Downloads Loaded Profiles: NorthP (Available Profiles: NorthP) Boot Mode: Normal ============================================== fixlist content: ***************** CreateRestorePoint: HKU\S-1-5-21-2954068360-2895956722-819088778-1000\...\Run: [Idpwsoft] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\NorthP\AppData\Local\Ixsmsoft\mzrfocnl.dll 2016-01-29 16:32 - 2016-01-29 20:08 - 00000000 ___HD C:\Id3Lfn01uMHjikvC 2016-01-29 16:32 - 2016-01-29 20:05 - 00086304 _____ C:\spyhunter.fix 2016-01-29 04:44 - 2016-01-30 03:34 - 00000000 ____D C:\Users\NorthP\AppData\Local\Ixsmsoft 2016-01-03 04:54 - 2016-01-30 01:32 - 00000000 __HDC C:\ProgramData\{CF8DBD9D-2EFD-44F7-8D23-93B5C27D06D7} 2016-01-30 03:33 - 2015-06-04 09:44 - 00000000 ___HD C:\Users\NorthP\AppData\Local\0haexzEvrlru 2016-01-30 03:33 - 2014-08-12 10:37 - 00000000 ___HD C:\Users\NorthP\AppData\Local\02gMIi2NGGFFA 2016-01-30 03:33 - 2013-09-03 10:05 - 00000000 ___HD C:\Users\NorthP\AppData\Local\3gfNVtPRgkCSz 2016-01-30 01:32 - 2015-12-16 17:45 - 00000000 __HDC C:\ProgramData\{61A19DCC-35CF-45F2-9B6E-078047DDC28D} 2016-01-30 01:32 - 2015-02-18 10:13 - 00000000 __HDC C:\ProgramData\{2149AC3A-6876-48A5-8ACC-4DDA07B383D2} 2016-01-30 01:32 - 2015-02-18 10:08 - 00000000 __HDC C:\ProgramData\{BD761B7D-CF85-4D9F-8742-F8457E267565} 2016-01-30 01:32 - 2015-02-18 10:08 - 00000000 __HDC C:\ProgramData\{4F1011FE-3478-4D2B-8F9F-7EA7C144DFC2} 2016-01-30 01:32 - 2015-01-22 21:40 - 00000000 __HDC C:\ProgramData\{D9FE1BCD-7CBB-4429-93E8-07869EFFE08A} 2016-01-30 01:32 - 2015-01-21 22:44 - 00000000 __HDC C:\ProgramData\{B895D3F6-931C-4B01-A8AC-DCDBBE28F2F9} 2016-01-30 01:32 - 2015-01-20 14:38 - 00000000 __HDC C:\ProgramData\{3342DAE4-E9C8-491C-8DD2-FA5D6CB18DA6} 2016-01-30 01:32 - 2015-01-10 16:57 - 00000000 __HDC C:\ProgramData\{B7072B15-6E80-42FF-A9AE-4E62AF2B2418} 2016-01-30 01:32 - 2015-01-10 16:57 - 00000000 __HDC C:\ProgramData\{30FA7941-4170-4C83-A9A8-FDF01C431704} 2016-01-30 01:32 - 2014-12-30 08:07 - 00000000 __HDC C:\ProgramData\{3006A797-CDFA-44FC-98EF-155579E2CDBF} 2016-01-30 01:32 - 2014-08-30 19:24 - 00000000 __HDC C:\ProgramData\{087E1953-389C-4129-84BB-41E86CBEDF56} 2016-01-30 01:32 - 2014-08-28 15:39 - 00000000 __HDC C:\ProgramData\{7FFC8429-59AA-4310-831D-BDA0FDF42089} 2016-01-30 01:32 - 2014-08-28 15:38 - 00000000 __HDC C:\ProgramData\{B219DF15-4D19-412B-8C2C-CA83D4B20892} 2016-01-30 01:32 - 2014-08-27 23:11 - 00000000 __HDC C:\ProgramData\{39752E59-CE7D-4919-9B7F-020F8C66116C} 2016-01-30 01:32 - 2014-08-01 16:09 - 00000000 __HDC C:\ProgramData\{0EB7C0FC-5BF4-474E-B5F9-A6E991727B3E} 2016-01-30 01:31 - 2015-01-24 01:53 - 00000000 ____D C:\ProgramData\Globalscape 2016-01-30 01:31 - 2015-01-22 04:11 - 00000000 ____D C:\ProgramData\boost_interprocess 2016-01-29 21:04 - 2014-10-03 19:23 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 CustomCLSID: HKU\S-1-5-21-2954068360-2895956722-819088778-1000_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32 -> C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\tsmf.dll => No File <==== ATTENTION AlternateDataStreams: C:\ProgramData:482EE99B1E21CE8C AlternateDataStreams: C:\Users\All Users:482EE99B1E21CE8C AlternateDataStreams: C:\ProgramData\Application Data:482EE99B1E21CE8C AlternateDataStreams: C:\ProgramData\Microsoft:7xcZvmHdFBJnUZimSwk0gtDC96 AlternateDataStreams: C:\ProgramData\Microsoft:gVfN0FPTVfOjPSFjHqANlWH AlternateDataStreams: C:\ProgramData\Microsoft:i2NGGFFAlczLYogETx7Q AlternateDataStreams: C:\ProgramData\Microsoft:ne5y7L4fHVZEgKaOGugDRO AlternateDataStreams: C:\ProgramData\Microsoft:PiFxbFf1UQbLYibTm AlternateDataStreams: C:\ProgramData\Microsoft:SBI6rIn2edCogjBSEO AlternateDataStreams: C:\ProgramData\Microsoft:sJhe70Itpv4JE0DaLZC90 AlternateDataStreams: C:\ProgramData\Microsoft:ZI8ZgrBvyMv5gGpVZ AlternateDataStreams: C:\Users\NorthP\Local Settings:4UNsWCrCgjU6aVv5jyIBgAvdS9ciU1 AlternateDataStreams: C:\Users\NorthP\AppData\Local:4UNsWCrCgjU6aVv5jyIBgAvdS9ciU1 AlternateDataStreams: C:\Users\NorthP\AppData\Local\0haexzEvrlru:loYhfQkyhruyVgOS6jOoJV87Hft4 AlternateDataStreams: C:\Users\NorthP\AppData\Local\Application Data:4UNsWCrCgjU6aVv5jyIBgAvdS9ciU1 AlternateDataStreams: C:\Users\NorthP\AppData\Local\Temp:APgmbFsNHUkqmmBCKq8U AlternateDataStreams: C:\Users\NorthP\AppData\Local\Temp:IkYXe9RayQEnEQVi6m AlternateDataStreams: C:\Users\NorthP\AppData\Local\Temporary Internet Files:ojPTaTF40NGo5ITIFS75BWvL12 C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8} Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers ***************** Restore point was successfully created. HKU\S-1-5-21-2954068360-2895956722-819088778-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Idpwsoft => value removed successfully C:\Id3Lfn01uMHjikvC => moved successfully C:\spyhunter.fix => moved successfully C:\Users\NorthP\AppData\Local\Ixsmsoft => moved successfully C:\ProgramData\{CF8DBD9D-2EFD-44F7-8D23-93B5C27D06D7} => moved successfully C:\Users\NorthP\AppData\Local\0haexzEvrlru => moved successfully C:\Users\NorthP\AppData\Local\02gMIi2NGGFFA => moved successfully C:\Users\NorthP\AppData\Local\3gfNVtPRgkCSz => moved successfully C:\ProgramData\{61A19DCC-35CF-45F2-9B6E-078047DDC28D} => moved successfully C:\ProgramData\{2149AC3A-6876-48A5-8ACC-4DDA07B383D2} => moved successfully C:\ProgramData\{BD761B7D-CF85-4D9F-8742-F8457E267565} => moved successfully C:\ProgramData\{4F1011FE-3478-4D2B-8F9F-7EA7C144DFC2} => moved successfully C:\ProgramData\{D9FE1BCD-7CBB-4429-93E8-07869EFFE08A} => moved successfully C:\ProgramData\{B895D3F6-931C-4B01-A8AC-DCDBBE28F2F9} => moved successfully C:\ProgramData\{3342DAE4-E9C8-491C-8DD2-FA5D6CB18DA6} => moved successfully C:\ProgramData\{B7072B15-6E80-42FF-A9AE-4E62AF2B2418} => moved successfully C:\ProgramData\{30FA7941-4170-4C83-A9A8-FDF01C431704} => moved successfully C:\ProgramData\{3006A797-CDFA-44FC-98EF-155579E2CDBF} => moved successfully C:\ProgramData\{087E1953-389C-4129-84BB-41E86CBEDF56} => moved successfully C:\ProgramData\{7FFC8429-59AA-4310-831D-BDA0FDF42089} => moved successfully C:\ProgramData\{B219DF15-4D19-412B-8C2C-CA83D4B20892} => moved successfully C:\ProgramData\{39752E59-CE7D-4919-9B7F-020F8C66116C} => moved successfully C:\ProgramData\{0EB7C0FC-5BF4-474E-B5F9-A6E991727B3E} => moved successfully C:\ProgramData\Globalscape => moved successfully C:\ProgramData\boost_interprocess => moved successfully C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 => moved successfully "HKU\S-1-5-21-2954068360-2895956722-819088778-1000_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}" => key removed successfully C:\ProgramData => ":482EE99B1E21CE8C" ADS removed successfully. "C:\Users\All Users" => ":482EE99B1E21CE8C" ADS not found. "C:\ProgramData\Application Data" => ":482EE99B1E21CE8C" ADS not found. C:\ProgramData\Microsoft => ":7xcZvmHdFBJnUZimSwk0gtDC96" ADS removed successfully. C:\ProgramData\Microsoft => ":gVfN0FPTVfOjPSFjHqANlWH" ADS removed successfully. C:\ProgramData\Microsoft => ":i2NGGFFAlczLYogETx7Q" ADS removed successfully. C:\ProgramData\Microsoft => ":ne5y7L4fHVZEgKaOGugDRO" ADS removed successfully. C:\ProgramData\Microsoft => ":PiFxbFf1UQbLYibTm" ADS removed successfully. C:\ProgramData\Microsoft => ":SBI6rIn2edCogjBSEO" ADS removed successfully. C:\ProgramData\Microsoft => ":sJhe70Itpv4JE0DaLZC90" ADS removed successfully. C:\ProgramData\Microsoft => ":ZI8ZgrBvyMv5gGpVZ" ADS removed successfully. "C:\Users\NorthP\Local Settings" => ":4UNsWCrCgjU6aVv5jyIBgAvdS9ciU1" ADS not found. C:\Users\NorthP\AppData\Local => ":4UNsWCrCgjU6aVv5jyIBgAvdS9ciU1" ADS removed successfully. "C:\Users\NorthP\AppData\Local\0haexzEvrlru" => ":loYhfQkyhruyVgOS6jOoJV87Hft4" ADS not found. "C:\Users\NorthP\AppData\Local\Application Data" => ":4UNsWCrCgjU6aVv5jyIBgAvdS9ciU1" ADS not found. C:\Users\NorthP\AppData\Local\Temp => ":APgmbFsNHUkqmmBCKq8U" ADS removed successfully. C:\Users\NorthP\AppData\Local\Temp => ":IkYXe9RayQEnEQVi6m" ADS removed successfully. "C:\Users\NorthP\AppData\Local\Temporary Internet Files" => ":ojPTaTF40NGo5ITIFS75BWvL12" ADS not found. "C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}" => not found. ========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f ========= The operation completed successfully. ========= End of Reg: ========= ========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f ========= The operation completed successfully. ========= End of Reg: ========= ========= RemoveProxy: ========= HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully HKU\S-1-5-21-2954068360-2895956722-819088778-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully HKU\S-1-5-21-2954068360-2895956722-819088778-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully ========= End of RemoveProxy: ========= ========= bitsadmin /reset /allusers ========= BITSADMIN version 3.0 [ 7.5.7601 ] BITS administration utility. (C) Copyright 2000-2006 Microsoft Corp. BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows. Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets. 0 out of 0 jobs canceled. ========= End of CMD: ========= EmptyTemp: => 23.1 GB temporary data Removed. The system needed a reboot. ==== End of Fixlog 15:59:32 ====