Fix result of Farbar Recovery Scan Tool (x64) Version: 25-09-2016 Ran by Zoe (26-09-2016 17:32:05) Run:1 Running from C:\Users\Zoe\Downloads Loaded Profiles: Zoe (Available Profiles: Zoe) Boot Mode: Normal ============================================== fixlist content: ***************** AutoConfigURL: [S-1-5-21-2616824965-1911769703-2517132435-1001] => hxxp://cdn1.browsersecurity.net/safe/cloud.js?si=77302&tid=18145&ver=5.7&ts=&tguid= Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 Tcpip\..\Interfaces\{657f2f94-4dd6-4f0b-90a6-2bb8088f42c3}: [DhcpNameServer] 82.163.143.171 Tcpip\..\Interfaces\{ccd3ab09-9ec8-47fc-892b-051904740ad5}: [NameServer] 82.163.143.171 82.163.142.173 Tcpip\..\Interfaces\{ccd3ab09-9ec8-47fc-892b-051904740ad5}: [DhcpNameServer] 192.168.1.254 Tcpip\..\Interfaces\{f654c49e-2000-425e-befd-42984e766052}: [DhcpNameServer] 82.163.143.171 ManualProxies: 0hxxp://cdn1.browsersecurity.net/safe/cloud.js?si=77302&tid=18145&ver=5.7&ts=&tguid= HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = HKU\S-1-5-21-2616824965-1911769703-2517132435-1001\Software\Microsoft\Internet Explorer\Main,Start Page = SearchScopes: HKLM -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = SearchScopes: HKU\S-1-5-21-2616824965-1911769703-2517132435-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = Task: {019635A3-170E-413F-A7D1-325922EE3244} - \{F388D17B-B090-41F1-8FB2-D66CDA7EE461} -> No File <==== ATTENTION Task: {15D0D1C7-C97F-441A-9365-3D9B8F1D6FE8} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION Task: {1D94F137-08E9-4354-A156-2A466ACE7F09} - \Microsoft\Windows\Setup\gwx\rundetector -> No File <==== ATTENTION Task: {2DA0B3CA-6FF6-4C8B-8736-B8B8FEFD6B94} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION Task: {2EDB54D5-FE03-41CA-B903-3F7E43A92754} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION Task: {35DC5F9F-0EB9-414A-A99C-FF696315B25D} - \DNSWALTERS -> No File <==== ATTENTION Task: {46737119-53BC-4F02-B384-5DE011878D6F} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION Task: {4D58CDE3-FC2D-4C0C-B214-94AC92AF6065} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION Task: {7545715E-2179-4194-A3B4-C12094C21F31} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend -> No File <==== ATTENTION Task: {7B108146-5310-4CB4-9F51-4631C9A15244} - \CreateChoiceProcessTask -> No File <==== ATTENTION Task: {80BB42F1-68B6-4322-869D-2804EE848126} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION Task: {8960CB18-6C66-495E-B56C-7F66541DF7DD} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION Task: {8EAD12AF-C8BB-4E50-B178-F5972D9D4391} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION Task: {9B053D66-4D29-4C6C-887D-3FE4CD0A6689} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION Task: {A9677DD3-9E55-4EF1-9149-3F254F1E9C28} - \User_Feed_Synchronization-{35E0D781-98D1-40BD-8C47-6F8C67A32793} -> No File <==== ATTENTION Task: {B2DC1BD7-019A-4EB3-8D7E-93ABC21DF2C1} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION Task: {D5090F70-F97C-44D8-93C8-1E41DA1D4786} - \WPD\SqmUpload_S-1-5-21-2616824965-1911769703-2517132435-1001 -> No File <==== ATTENTION Task: {E65370DA-E012-48A6-B6BB-EFF7EC248C40} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION Task: {ECF8D250-408D-4B31-B5C1-3176FC350A05} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION Task: {F86A547D-F71A-4DDD-BC11-9150285ACD35} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\WpsNotifyTask_Zoe.job => C:\Users\Zoe\AppData\Local\kingsoft\WPS Office\10.1.0.5507\wtoolex\wpsnotify.exe Task: C:\WINDOWS\Tasks\WpsUpdateTask_Zoe.job => C:\Users\Zoe\AppData\Local\kingsoft\WPS Office\10.1.0.5507\wtoolex\wpsupdate.exe Shortcut: C:\Users\Zoe\AppData\Local\Microsoft\Windows\RoamingTiles\16272922270.lnk -> hxxp://www.ebay.co.uk/ ShortcutWithArgument: C:\Users\Zoe\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\16272922270.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000002 -pinnedTimeLow 0x5e21b6ba -pinnedTimeHigh 0x01cee455 -securityFlags 0x00000000 -url 0x00000016 hxxp://www.ebay.co.uk/ ShortcutWithArgument: C:\Users\Zoe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\55abbe2b5e9227c7\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default HKU\S-1-5-21-2616824965-1911769703-2517132435-1001\...\MountPoints2: {9a17719e-9cdb-11e4-824f-806e6f6e6963} - "E:\bin\fehcdautorun.exe" ***************** HKU\S-1-5-21-2616824965-1911769703-2517132435-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\AutoConfigURL => value removed successfully HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\\DhcpNameServer => value removed successfully HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{657f2f94-4dd6-4f0b-90a6-2bb8088f42c3}\\DhcpNameServer => value removed successfully HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{ccd3ab09-9ec8-47fc-892b-051904740ad5}\\NameServer => value removed successfully HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{ccd3ab09-9ec8-47fc-892b-051904740ad5}\\DhcpNameServer => value removed successfully HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{f654c49e-2000-425e-befd-42984e766052}\\DhcpNameServer => value removed successfully HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet\ManualProxies\\ => value removed successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKU\S-1-5-21-2616824965-1911769703-2517132435-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2f23ab71-4ac6-41f2-a955-ea576e553146}" => key removed successfully HKCR\CLSID\{2f23ab71-4ac6-41f2-a955-ea576e553146} => key not found. HKU\S-1-5-21-2616824965-1911769703-2517132435-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{019635A3-170E-413F-A7D1-325922EE3244}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{019635A3-170E-413F-A7D1-325922EE3244}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{F388D17B-B090-41F1-8FB2-D66CDA7EE461}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{15D0D1C7-C97F-441A-9365-3D9B8F1D6FE8}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15D0D1C7-C97F-441A-9365-3D9B8F1D6FE8}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1D94F137-08E9-4354-A156-2A466ACE7F09}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1D94F137-08E9-4354-A156-2A466ACE7F09}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\rundetector" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2DA0B3CA-6FF6-4C8B-8736-B8B8FEFD6B94}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2DA0B3CA-6FF6-4C8B-8736-B8B8FEFD6B94}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2EDB54D5-FE03-41CA-B903-3F7E43A92754}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2EDB54D5-FE03-41CA-B903-3F7E43A92754}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{35DC5F9F-0EB9-414A-A99C-FF696315B25D}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{35DC5F9F-0EB9-414A-A99C-FF696315B25D}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DNSWALTERS" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{46737119-53BC-4F02-B384-5DE011878D6F}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{46737119-53BC-4F02-B384-5DE011878D6F}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4D58CDE3-FC2D-4C0C-B214-94AC92AF6065}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D58CDE3-FC2D-4C0C-B214-94AC92AF6065}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7545715E-2179-4194-A3B4-C12094C21F31}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7545715E-2179-4194-A3B4-C12094C21F31}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-Weekend" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7B108146-5310-4CB4-9F51-4631C9A15244}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7B108146-5310-4CB4-9F51-4631C9A15244}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\CreateChoiceProcessTask" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{80BB42F1-68B6-4322-869D-2804EE848126}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{80BB42F1-68B6-4322-869D-2804EE848126}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8960CB18-6C66-495E-B56C-7F66541DF7DD}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8960CB18-6C66-495E-B56C-7F66541DF7DD}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8EAD12AF-C8BB-4E50-B178-F5972D9D4391}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8EAD12AF-C8BB-4E50-B178-F5972D9D4391}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9B053D66-4D29-4C6C-887D-3FE4CD0A6689}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9B053D66-4D29-4C6C-887D-3FE4CD0A6689}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A9677DD3-9E55-4EF1-9149-3F254F1E9C28}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A9677DD3-9E55-4EF1-9149-3F254F1E9C28}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\User_Feed_Synchronization-{35E0D781-98D1-40BD-8C47-6F8C67A32793}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B2DC1BD7-019A-4EB3-8D7E-93ABC21DF2C1}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B2DC1BD7-019A-4EB3-8D7E-93ABC21DF2C1}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D5090F70-F97C-44D8-93C8-1E41DA1D4786}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D5090F70-F97C-44D8-93C8-1E41DA1D4786}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WPD\SqmUpload_S-1-5-21-2616824965-1911769703-2517132435-1001" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E65370DA-E012-48A6-B6BB-EFF7EC248C40}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E65370DA-E012-48A6-B6BB-EFF7EC248C40}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{ECF8D250-408D-4B31-B5C1-3176FC350A05}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ECF8D250-408D-4B31-B5C1-3176FC350A05}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{F86A547D-F71A-4DDD-BC11-9150285ACD35}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F86A547D-F71A-4DDD-BC11-9150285ACD35}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => key removed successfully C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => moved successfully C:\WINDOWS\Tasks\WpsNotifyTask_Zoe.job => moved successfully C:\WINDOWS\Tasks\WpsUpdateTask_Zoe.job => moved successfully C:\Users\Zoe\AppData\Local\Microsoft\Windows\RoamingTiles\16272922270.lnk => moved successfully C:\Users\Zoe\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\16272922270.lnk => Shortcut argument removed successfully. C:\Users\Zoe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\55abbe2b5e9227c7\Google Chrome.lnk => Shortcut argument removed successfully. "HKU\S-1-5-21-2616824965-1911769703-2517132435-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9a17719e-9cdb-11e4-824f-806e6f6e6963}" => key removed successfully HKCR\CLSID\{9a17719e-9cdb-11e4-824f-806e6f6e6963} => key not found. ==== End of Fixlog 17:32:06 ====