Fix result of Farbar Recovery Scan Tool (x64) Version:13-06-2015 Ran by Roland at 2015-06-20 10:19:14 Run:1 Running from C:\Users\Roland\Downloads Loaded Profiles: Roland (Available Profiles: Roland) Boot Mode: Normal ============================================== fixlist content: ***************** Format du document : text/plain start CloseProcesses: CreateRestorePoint: C: PROGRAM Files REIMAGE\Reimage Protector\ReiGuard.exe C:\ProgramData\c716fd70-872c-4aaa-a07f-e248365d7f56\plugins\6\Plugin.exe C:\ProgramData\c716fd70-872c-4aaa-a07f-e248365d7f56\plugins\3\Plugin.exe C:\ProgramData\c716fd70-872c-4aaa-a07f-e248365d7f56\plugins\4\Plugin.exe C:\ProgramData\c716fd70-872c-4aaa-a07f-e248365d7f56\plugins\5\Plugin.exe C:\ProgramData\c716fd70-872c-4aaa-a07f-e248365d7f56\plugins\2\Plugin.exe C:\ProgramData\c716fd70-872c-4aaa-a07f-e248365d7f56\plugins\8\Plugin.exe GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428&q={searchTerms} SearchScopes: HKLM -> OldSearch URL = http://www.sweet-page.com/web/?type=ds&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428&q={searchTerms} SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://fr.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_secureddownload_15_21¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDyBzyyDzyzztC0B0F0DtByByE0AtCtN0D0Tzu0StCtBtAzytN1L2XzutAtFtCtDtFtCtDtFtDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StByEzzyBzy0F0DtBtGyC0FyEyEtGyE0CzytDtGtAtAzzzztGyCyB0Bzz0EyDtAyBzyyDtBtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0A0DyByEyB0CtDyEtG0FtD0E0FtGyEyEtCtBtGzyzyzz0AtG0FtD0AyEtC0CtA0F0DyCtBtA2QtN0A0LzuyE%26cr%3D1612253123%26a%3Dwncy_secureddownload_15_21%26os%3DWindows 8.1&p={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428&q={searchTerms} SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428&q={searchTerms} SearchScopes: HKU\S-1-5-21-3157952996-1925456827-2438661710-1001 -> OldSearch URL = http://fr.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_secureddownload_15_21¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtDyBzyyDzyzztC0B0F0DtByByE0AtCtN0D0Tzu0StCtBtAzytN1L2XzutAtFtCtDtFtCtDtFtDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StByEzzyBzy0F0DtBtGyC0FyEyEtGyE0CzytDtGtAtAzzzztGyCyB0Bzz0EyDtAyBzyyDtBtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0A0DyByEyB0CtDyEtG0FtD0E0FtGyEyEtCtBtGzyzyzz0AtG0FtD0AyEtC0CtA0F0DyCtBtA2QtN0A0LzuyE%26cr%3D1612253123%26a%3Dwncy_secureddownload_15_21%26os%3DWindows 8.1&p={searchTerms} SearchScopes: HKU\S-1-5-21-3157952996-1925456827-2438661710-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1429879288&from=corfr&uid=ST1000LM024XHN-M101MBB_S32XJ9BF991428&q={searchTerms} CHR HKU\S-1-5-21-3157952996-1925456827-2438661710-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [kfecnpmgnlnbmipaogfhoacoioifjgko] - http://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [kfecnpmgnlnbmipaogfhoacoioifjgko] - http://clients2.google.com/service/update2/crx R2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [7410024 2015-01-14] (Reimage®) 2015-06-18 16:36 - 2015-06-18 16:36 - 00000000 ____H C:\Users\Roland\AppData\Local\BITA47.tmp 2015-06-18 16:34 - 2015-04-23 02:24 - 00000093 _____ C:\Users\Roland\AppData\Roaming\sp_data.sys 2015-04-23 02:24 - 2015-06-18 16:34 - 0000093 _____ () C:\Users\Roland\AppData\Roaming\sp_data.sys 2014-10-29 08:25 - 2009-07-22 12:04 - 0024576 _____ () C:\ProgramData\SetStretch.exe 2014-10-29 08:25 - 2012-09-07 13:37 - 0000103 _____ () C:\ProgramData\SetStretch.VBS C:\ProgramData\SetStretch.exe C:\ProgramData\SetStretch.VBS Reimage Protector (HKLM\...\Reimage Protector) (Version: - Reimage) <==== ATTENTION Task: {C164FA8C-6C2C-4DDC-9AC1-30B636257601} - System32\Tasks\LaunchPreSignup => C:\Program Files (x86)\OLBPre\OLBPre.exe <==== ATTENTION Task: {E678C35E-39DB-49E2-85E2-D1DA4C3DD416} - \ReimageUpdater No Task File <==== ATTENTION EmptyTemp: end ***************** Format du document : text/plain => Error: No automatic fix found for this entry. Processes closed successfully. Restore point was successfully created. C: PROGRAM Files REIMAGE\Reimage Protector\ReiGuard.exe => Error: No automatic fix found for this entry. C:\ProgramData\c716fd70-872c-4aaa-a07f-e248365d7f56\plugins\6\Plugin.exe => moved successfully. C:\ProgramData\c716fd70-872c-4aaa-a07f-e248365d7f56\plugins\3\Plugin.exe => moved successfully. C:\ProgramData\c716fd70-872c-4aaa-a07f-e248365d7f56\plugins\4\Plugin.exe => moved successfully. C:\ProgramData\c716fd70-872c-4aaa-a07f-e248365d7f56\plugins\5\Plugin.exe => moved successfully. C:\ProgramData\c716fd70-872c-4aaa-a07f-e248365d7f56\plugins\2\Plugin.exe => moved successfully. C:\ProgramData\c716fd70-872c-4aaa-a07f-e248365d7f56\plugins\8\Plugin.exe => moved successfully. C:\Windows\system32\GroupPolicy\Machine => moved successfully. C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully. HKU\CHR HKLM SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION\SOFTWARE\Policies\Google => key not found. HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\OldSearch" => key removed successfully HKCR\CLSID\OldSearch => key not found. "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => key removed successfully HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => key not found. "HKU\S-1-5-21-3157952996-1925456827-2438661710-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\OldSearch" => key removed successfully HKCR\CLSID\OldSearch => key not found. "HKU\S-1-5-21-3157952996-1925456827-2438661710-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => key removed successfully HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => key not found. "HKU\S-1-5-21-3157952996-1925456827-2438661710-1001\SOFTWARE\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko" => key removed successfully "HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko" => key removed successfully ReimageRealTimeProtector => Service removed successfully "C:\Users\Roland\AppData\Local\BITA47.tmp" => File/Folder not found. C:\Users\Roland\AppData\Roaming\sp_data.sys => moved successfully. "C:\Users\Roland\AppData\Roaming\sp_data.sys" => File/Folder not found. C:\ProgramData\SetStretch.exe => moved successfully. C:\ProgramData\SetStretch.VBS => moved successfully. "C:\ProgramData\SetStretch.exe" => File/Folder not found. "C:\ProgramData\SetStretch.VBS" => File/Folder not found. Reimage Protector (HKLM\...\Reimage Protector) (Version: - Reimage) <==== ATTENTION => Error: No automatic fix found for this entry. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C164FA8C-6C2C-4DDC-9AC1-30B636257601}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C164FA8C-6C2C-4DDC-9AC1-30B636257601}" => key removed successfully C:\Windows\System32\Tasks\LaunchPreSignup => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\LaunchPreSignup" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{E678C35E-39DB-49E2-85E2-D1DA4C3DD416}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E678C35E-39DB-49E2-85E2-D1DA4C3DD416}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ReimageUpdater" => key removed successfully EmptyTemp: => 65.5 MB temporary data Removed. The system needed a reboot.. ==== End of Fixlog 10:20:34 ====