Fix result of Farbar Recovery Scan Tool (x64) Version:26-07-2015 Ran by Nicolas at 2015-07-26 19:29:03 Run:1 Running from C:\Users\Nicolas\Desktop Loaded Profiles: Nicolas (Available Profiles: Nicolas) Boot Mode: Normal ============================================== fixlist content: ***************** start CloseProcesses: Hosts: CreateRestorePoint: (Roozz) C:\Program Files (x86)\Roozz\Updater.exe GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION URLSearchHook: HKU\S-1-5-21-3365763394-745426455-204747936-1001 - (No Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3365763394-745426455-204747936-1001 -> DefaultScope {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = BHO-x32: eye perform 1.0.0.7 -> {7768ecae-6b40-4398-bef1-db0a206f0009} -> C:\Program Files (x86)\eye perform\eyeperformbho.dll [2015-07-15] () BHO-x32: No Name -> {84FF7BD6-B47F-46F8-9130-01B2696B36CB} -> No File C:\Program Files (x86)\eye perform\eyeperformbho.dll FF DefaultSearchEngine,S: WebSearch FF DefaultSearchUrl: hxxp://websearch.searchfix.info/?unqvl=63&idate=2015/06/04&l=1&q= FF SearchEngineOrder.1: WebSearch FF SearchEngineOrder.1,S: WebSearch FF SelectedSearchEngine,S: WebSearch FF Keyword.URL: hxxp://websearch.searchfix.info/?unqvl=63&idate=2015/06/04&l=1&q= FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2012-06-04] (Pando Networks) FF Plugin-x32: @Roozz.com/RoozzPlugin -> C:\Program Files (x86)\Roozz\nproozz.dll [2013-10-25] (Roozz.com) FF Plugin HKU\S-1-5-21-3365763394-745426455-204747936-1001: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2012-06-04] (Pando Networks) FF Plugin HKU\S-1-5-21-3365763394-745426455-204747936-1001: pokki.com/PokkiDownloadHelper -> C:\Users\Nicolas\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll No File CHR dev: Chrome dev build detected! <======= ATTENTION CHR Extension: (Tampermonkey) - C:\Users\Nicolas\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2014-09-10] S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4687672 2012-05-15] (INCA Internet Co., Ltd.) [File not signed] S2 699fd52f; "C:\Windows\system32\rundll32.exe" "c:\progra~3\assist~1\AssistantSvc.dll",service 2015-07-25 18:44 - 2015-07-25 18:44 - 00003212 _____ C:\Windows\System32\Tasks\BoBrowser C:\Windows\System32\Tasks\BoBrowser 2015-07-25 18:35 - 2015-07-25 18:35 - 00003760 _____ C:\Windows\System32\Tasks\Selection Tools Update 2015-07-25 18:35 - 2015-07-25 18:35 - 00003726 _____ C:\Windows\System32\Tasks\WindApp Update 2015-07-25 18:35 - 2015-07-25 18:35 - 00000078 _____ C:\Users\Nicolas\AppData\Roaming\WindApp.installation.log 2015-07-25 18:35 - 2015-07-25 18:35 - 00000078 _____ C:\Users\Nicolas\AppData\Roaming\Selection Tools.installation.log 2015-07-25 18:33 - 2015-07-25 18:35 - 00005725 _____ C:\Users\Nicolas\AppData\Roaming\Bubble Dock.installation.log 2015-07-25 18:33 - 2015-07-25 18:33 - 00000097 _____ C:\Users\Nicolas\AppData\Roaming\WindApp.boostrap.log 2015-07-25 18:32 - 2015-07-25 18:35 - 00001261 _____ C:\Users\Nicolas\AppData\Roaming\Bubble Dock.boostrap.log 2015-07-25 18:29 - 2015-07-25 18:30 - 00000000 ____D C:\Program Files (x86)\eye perform 2015-07-25 18:32 - 2015-07-25 18:35 - 0001261 _____ () C:\Users\Nicolas\AppData\Roaming\Bubble Dock.boostrap.log 2015-07-25 18:33 - 2015-07-25 18:35 - 0005725 _____ () C:\Users\Nicolas\AppData\Roaming\Bubble Dock.installation.log 2015-07-25 18:35 - 2015-07-25 18:35 - 0000078 _____ () C:\Users\Nicolas\AppData\Roaming\Selection Tools.installation.log 2015-07-25 18:33 - 2015-07-25 18:33 - 0000097 _____ () C:\Users\Nicolas\AppData\Roaming\WindApp.boostrap.log 2015-07-25 18:35 - 2015-07-25 18:35 - 0000078 _____ () C:\Users\Nicolas\AppData\Roaming\WindApp.installation.log 2013-02-22 19:11 - 2013-02-22 19:11 - 0000095 _____ () C:\Users\Nicolas\AppData\Local\fusioncache.dat 2011-10-19 06:26 - 2010-10-06 18:45 - 0131984 _____ () C:\ProgramData\FullRemove.exe 2013-02-16 14:08 - 2012-12-18 14:08 - 0000032 ____R () C:\ProgramData\hash.dat 2012-01-26 02:31 - 2012-01-26 02:31 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log 2012-01-26 02:30 - 2012-01-26 02:31 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log 2012-01-26 02:29 - 2012-01-26 02:30 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log C:\ProgramData\hash.dat CustomCLSID: HKU\S-1-5-21-3365763394-745426455-204747936-1001_Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}\localserver32 -> C:\Users\Nicolas\AppData\Local\Chromium\Application\42.0.2302.0\delegate_execute.exe (The Chromium Authors) <==== ATTENTION CustomCLSID: HKU\S-1-5-21-3365763394-745426455-204747936-1001_Classes\CLSID\{A75BE48D-BF58-4A8B-B96C-F9A09DFB9844}\InprocServer32 -> C:\Users\Nicolas\AppData\Local\Pokki\ocdeskband_0.dll () Task: {001988C3-492A-4AB3-BAB2-37232446068D} - System32\Tasks\WindApp Update => C:\Users\Nicolas\AppData\Roaming\Store\WindApp\WindApp Update.exe <==== ATTENTION Task: {00C4AEA4-A5E3-48FB-BC16-2AA0FCF295B5} - System32\Tasks\ScienceCrew => c:\programdata\{7e2d7cdc-4f2e-3b91-7e2d-d7cdc4f2f371}\2025684959197814349b.exe [2014-07-23] () <==== ATTENTION Task: {07FE7543-EE4D-49E4-AE6B-749AF81D847F} - System32\Tasks\BarHelper => c:\programdata\{d11c4418-1f7e-f550-d11c-c44181f71060}\9174667573535515490b.exe [2014-07-21] () <==== ATTENTION Task: {132D22F0-E793-4DF6-9F19-08F455322CF2} - System32\Tasks\LaunchPreSignup => C:\Program Files (x86)\OLBPre\OLBPre.exe <==== ATTENTION Task: {5767BE9F-7D02-4D32-BF38-1CD694AA65C4} - System32\Tasks\ShadowLoader => c:\programdata\{477974d0-32c1-2821-4779-974d032cd340}\2997578668842450996b.exe [2014-07-23] () <==== ATTENTION Task: {72A0AD35-FAED-4F5F-876D-042BB99DA2CD} - System32\Tasks\BoBrowser => C:\Users\Nicolas\AppData\Local\BoBrowser\Application\bobrowser.exe Task: {79500A71-8EE2-4C53-8276-F429AF6AA48E} - System32\Tasks\BoxSoftwareUpdate => C:\ProgramData\BoxUpdChk\updchk.exe <==== ATTENTION Task: {98C70747-0459-4713-830D-99841E6A277F} - System32\Tasks\RunAsStdUser Task => C:\Users\Nicolas\AppData\Local\gigglinggamesSA\bin\1.0.6.0\GigglingGamesSA.exe <==== ATTENTION Task: {B15047C7-9110-4A9A-A60A-CCFDBF96CFA8} - System32\Tasks\InstaGainz => c:\programdata\{82c16df8-8d54-dd43-82c1-16df88d5b7e2}\8526611957047196262b.exe [2014-07-21] () <==== ATTENTION Task: {CD55481F-FAE3-4561-A538-C5B00D755F36} - System32\Tasks\Run_Bobby_Browser => C:\Users\Nicolas\AppData\Local\BoBrowser\Application\bobrowser.exe <==== ATTENTION Task: {DB8DAEFE-5A18-4C9B-9348-7EB02235AD45} - System32\Tasks\Sunrise => C:\Windows\TEMP\CUpdater\s4ts..exe Task: C:\Windows\Tasks\BarHelper.job => c:\programdata\{d11c4418-1f7e-f550-d11c-c44181f71060}\9174667573535515490b.exe <==== ATTENTION Task: C:\Windows\Tasks\BikeHunt.job => c:\programdata\{97ff4da3-614f-65f9-97ff-f4da3614368d}\585398133833966672b.exe <==== ATTENTION Task: C:\Windows\Tasks\InstaGainz.job => c:\programdata\{82c16df8-8d54-dd43-82c1-16df88d5b7e2}\8526611957047196262b.exe <==== ATTENTION Task: C:\Windows\Tasks\ScienceCrew.job => c:\programdata\{7e2d7cdc-4f2e-3b91-7e2d-d7cdc4f2f371}\2025684959197814349b.exe <==== ATTENTION Task: C:\Windows\Tasks\ShadowLoader.job => c:\programdata\{477974d0-32c1-2821-4779-974d032cd340}\2997578668842450996b.exe <==== ATTENTION Task: C:\Windows\Tasks\TattooCrew.job => c:\programdata\{3746d969-61bf-33c9-3746-6d96961b65a5}\3384774128958037486b.exe <==== ATTENTION AlternateDataStreams: C:\ProgramData\Temp:D20FFA63 MSCONFIG\startupreg: WindApp => "C:\Users\Nicolas\AppData\Roaming\Store\WindApp\WindApp.exe" /winstartup FirewallRules: [{BEDBBF8B-3495-43F6-843E-500B890199B5}] => (Allow) C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe FirewallRules: [{F1BC538C-703D-4B65-97D9-8C239A2CF914}] => (Allow) C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe FirewallRules: [{514CDDDF-23D3-4D7D-B6C9-5934C07F7416}] => (Allow) C:\Program Files (x86)\Iminent\Iminent.exe FirewallRules: [{E8B00A13-8266-4F33-B4AE-EF0AAC3C9FC2}] => (Allow) C:\Program Files (x86)\Iminent\Iminent.Messengers.exe FirewallRules: [{B473AA66-E2F1-498A-AC76-F86030AFDD51}] => (Allow) C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe FirewallRules: [{BD4D461A-BDD2-4207-B560-65198A4F6076}] => (Allow) C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe C:\Program Files (x86)\Iminent\Iminent.exe C:\Program Files (x86)\Iminent\Iminent.Messengers.exe FirewallRules: [{221BBC09-3665-4D1D-AA87-2FDD22AB48E3}] => (Allow) C:\Users\Nicolas\AppData\Local\BoBrowser\Application\bobrowser.exe 2015-07-23 21:42 - 2015-07-25 21:42 - 00000358 _____ C:\Windows\Tasks\ShadowLoader.job 2015-07-23 21:42 - 2015-07-23 21:42 - 00003274 _____ C:\Windows\System32\Tasks\ShadowLoader 2015-07-23 15:42 - 2015-07-25 21:42 - 00000358 _____ C:\Windows\Tasks\ScienceCrew.job 2015-07-23 15:42 - 2015-07-23 15:42 - 00003274 _____ C:\Windows\System32\Tasks\ScienceCrew 2015-07-22 21:42 - 2015-07-25 21:42 - 00000358 _____ C:\Windows\Tasks\TattooCrew.job 2015-07-22 21:42 - 2015-07-22 21:42 - 00003274 _____ C:\Windows\System32\Tasks\TattooCrew 2015-07-21 21:42 - 2015-07-25 21:42 - 00000356 _____ C:\Windows\Tasks\BikeHunt.job 2015-07-21 21:42 - 2015-07-21 21:42 - 00003272 _____ C:\Windows\System32\Tasks\BikeHunt 2015-07-21 15:42 - 2015-07-25 21:42 - 00000358 _____ C:\Windows\Tasks\BarHelper.job 2015-07-21 15:42 - 2015-07-21 15:42 - 00003274 _____ C:\Windows\System32\Tasks\BarHelper EmptyTemp: end ***************** Processes closed successfully. C:\Windows\System32\Drivers\etc\hosts => moved successfully. Hosts restored successfully. Restore point was successfully created. C:\Program Files (x86)\Roozz\Updater.exe => No running process found C:\Windows\system32\GroupPolicy\Machine => moved successfully. C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully. C:\Windows\SysWOW64\GroupPolicy\GPT.ini => moved successfully. "HKLM\SOFTWARE\Policies\Google" => key removed successfully HKU\S-1-5-21-3365763394-745426455-204747936-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{84FF7BD6-B47F-46F8-9130-01B2696B36CB} => value removed successfully HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully HKU\S-1-5-21-3365763394-745426455-204747936-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7768ecae-6b40-4398-bef1-db0a206f0009}" => key removed successfully "HKCR\Wow6432Node\CLSID\{7768ecae-6b40-4398-bef1-db0a206f0009}" => key removed successfully "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}" => key removed successfully HKCR\Wow6432Node\CLSID\{84FF7BD6-B47F-46F8-9130-01B2696B36CB} => key not found. C:\Program Files (x86)\eye perform\eyeperformbho.dll => moved successfully. Firefox DefaultSearchEngine,S removed successfully Firefox DefaultSearchUrl removed successfully Firefox SearchEngineOrder.1 removed successfully Firefox SearchEngineOrder.1,S removed successfully Firefox SelectedSearchEngine,S removed successfully Firefox Keyword.URL removed successfully "HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin" => key removed successfully C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll => moved successfully. "HKLM\Software\Wow6432Node\MozillaPlugins\@Roozz.com/RoozzPlugin" => key removed successfully C:\Program Files (x86)\Roozz\nproozz.dll => moved successfully. "HKU\S-1-5-21-3365763394-745426455-204747936-1001\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin" => key removed successfully C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll not found. "HKU\S-1-5-21-3365763394-745426455-204747936-1001\Software\MozillaPlugins\pokki.com/PokkiDownloadHelper" => key removed successfully C:\Users\Nicolas\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll not found. CHR dev: Chrome dev build detected! <======= ATTENTION => Error: No automatic fix found for this entry. C:\Users\Nicolas\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo => moved successfully. npggsvc => service removed successfully 699fd52f => service removed successfully C:\Windows\System32\Tasks\BoBrowser => moved successfully. "C:\Windows\System32\Tasks\BoBrowser" => File/Folder not found. C:\Windows\System32\Tasks\Selection Tools Update => moved successfully. C:\Windows\System32\Tasks\WindApp Update => moved successfully. C:\Users\Nicolas\AppData\Roaming\WindApp.installation.log => moved successfully. C:\Users\Nicolas\AppData\Roaming\Selection Tools.installation.log => moved successfully. C:\Users\Nicolas\AppData\Roaming\Bubble Dock.installation.log => moved successfully. C:\Users\Nicolas\AppData\Roaming\WindApp.boostrap.log => moved successfully. C:\Users\Nicolas\AppData\Roaming\Bubble Dock.boostrap.log => moved successfully. C:\Program Files (x86)\eye perform => moved successfully. "C:\Users\Nicolas\AppData\Roaming\Bubble Dock.boostrap.log" => File/Folder not found. "C:\Users\Nicolas\AppData\Roaming\Bubble Dock.installation.log" => File/Folder not found. "C:\Users\Nicolas\AppData\Roaming\Selection Tools.installation.log" => File/Folder not found. "C:\Users\Nicolas\AppData\Roaming\WindApp.boostrap.log" => File/Folder not found. "C:\Users\Nicolas\AppData\Roaming\WindApp.installation.log" => File/Folder not found. C:\Users\Nicolas\AppData\Local\fusioncache.dat => moved successfully. C:\ProgramData\FullRemove.exe => moved successfully. C:\ProgramData\hash.dat => moved successfully. C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log => moved successfully. C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log => moved successfully. C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log => moved successfully. "C:\ProgramData\hash.dat" => File/Folder not found. "HKU\S-1-5-21-3365763394-745426455-204747936-1001_Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}" => key removed successfully "HKU\S-1-5-21-3365763394-745426455-204747936-1001_Classes\CLSID\{A75BE48D-BF58-4A8B-B96C-F9A09DFB9844}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{001988C3-492A-4AB3-BAB2-37232446068D}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{001988C3-492A-4AB3-BAB2-37232446068D}" => key removed successfully C:\Windows\System32\Tasks\WindApp Update not found. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WindApp Update" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{00C4AEA4-A5E3-48FB-BC16-2AA0FCF295B5}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{00C4AEA4-A5E3-48FB-BC16-2AA0FCF295B5}" => key removed successfully C:\Windows\System32\Tasks\ScienceCrew => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ScienceCrew" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{07FE7543-EE4D-49E4-AE6B-749AF81D847F}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{07FE7543-EE4D-49E4-AE6B-749AF81D847F}" => key removed successfully C:\Windows\System32\Tasks\BarHelper => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BarHelper" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{132D22F0-E793-4DF6-9F19-08F455322CF2}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{132D22F0-E793-4DF6-9F19-08F455322CF2}" => key removed successfully C:\Windows\System32\Tasks\LaunchPreSignup => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\LaunchPreSignup" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5767BE9F-7D02-4D32-BF38-1CD694AA65C4}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5767BE9F-7D02-4D32-BF38-1CD694AA65C4}" => key removed successfully C:\Windows\System32\Tasks\ShadowLoader => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ShadowLoader" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{72A0AD35-FAED-4F5F-876D-042BB99DA2CD}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{72A0AD35-FAED-4F5F-876D-042BB99DA2CD}" => key removed successfully C:\Windows\System32\Tasks\BoBrowser not found. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BoBrowser" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{79500A71-8EE2-4C53-8276-F429AF6AA48E}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{79500A71-8EE2-4C53-8276-F429AF6AA48E}" => key removed successfully C:\Windows\System32\Tasks\BoxSoftwareUpdate => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BoxSoftwareUpdate" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{98C70747-0459-4713-830D-99841E6A277F}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{98C70747-0459-4713-830D-99841E6A277F}" => key removed successfully C:\Windows\System32\Tasks\RunAsStdUser Task => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RunAsStdUser Task" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B15047C7-9110-4A9A-A60A-CCFDBF96CFA8}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B15047C7-9110-4A9A-A60A-CCFDBF96CFA8}" => key removed successfully C:\Windows\System32\Tasks\InstaGainz => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\InstaGainz" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CD55481F-FAE3-4561-A538-C5B00D755F36}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CD55481F-FAE3-4561-A538-C5B00D755F36}" => key removed successfully C:\Windows\System32\Tasks\Run_Bobby_Browser => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Run_Bobby_Browser" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DB8DAEFE-5A18-4C9B-9348-7EB02235AD45}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DB8DAEFE-5A18-4C9B-9348-7EB02235AD45}" => key removed successfully C:\Windows\System32\Tasks\Sunrise => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Sunrise" => key removed successfully C:\Windows\Tasks\BarHelper.job => moved successfully. C:\Windows\Tasks\BikeHunt.job => moved successfully. C:\Windows\Tasks\InstaGainz.job => moved successfully. C:\Windows\Tasks\ScienceCrew.job => moved successfully. C:\Windows\Tasks\ShadowLoader.job => moved successfully. C:\Windows\Tasks\TattooCrew.job => moved successfully. C:\ProgramData\Temp => ":D20FFA63" ADS removed successfully. MSCONFIG\startupreg: WindApp => "C:\Users\Nicolas\AppData\Roaming\Store\WindApp\WindApp.exe" /winstartup => Error: No automatic fix found for this entry. HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{BEDBBF8B-3495-43F6-843E-500B890199B5} => value removed successfully HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{F1BC538C-703D-4B65-97D9-8C239A2CF914} => value removed successfully HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{514CDDDF-23D3-4D7D-B6C9-5934C07F7416} => value removed successfully HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{E8B00A13-8266-4F33-B4AE-EF0AAC3C9FC2} => value removed successfully HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{B473AA66-E2F1-498A-AC76-F86030AFDD51} => value removed successfully HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{BD4D461A-BDD2-4207-B560-65198A4F6076} => value removed successfully "C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe" => File/Folder not found. "C:\Program Files (x86)\Iminent\Iminent.exe" => File/Folder not found. "C:\Program Files (x86)\Iminent\Iminent.Messengers.exe" => File/Folder not found. HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{221BBC09-3665-4D1D-AA87-2FDD22AB48E3} => value removed successfully "C:\Windows\Tasks\ShadowLoader.job" => File/Folder not found. "C:\Windows\System32\Tasks\ShadowLoader" => File/Folder not found. "C:\Windows\Tasks\ScienceCrew.job" => File/Folder not found. "C:\Windows\System32\Tasks\ScienceCrew" => File/Folder not found. "C:\Windows\Tasks\TattooCrew.job" => File/Folder not found. C:\Windows\System32\Tasks\TattooCrew => moved successfully. "C:\Windows\Tasks\BikeHunt.job" => File/Folder not found. C:\Windows\System32\Tasks\BikeHunt => moved successfully. "C:\Windows\Tasks\BarHelper.job" => File/Folder not found. "C:\Windows\System32\Tasks\BarHelper" => File/Folder not found. EmptyTemp: => 1 GB temporary data Removed. The system needed a reboot.. ==== End of Fixlog 19:31:32 ====