Fix result of Farbar Recovery Scan Tool (x64) Version: 15-03-2017 Ran by NoCanDo (19-03-2017 21:25:22) Run:2 Running from C:\Users\NoCanDo\Downloads Loaded Profiles: NoCanDo (Available Profiles: NoCanDo) Boot Mode: Normal ============================================== fixlist content: ***************** start CreateRestorePoint: CloseProcesses: RemoveProxy: HKU\S-1-5-21-3779877807-738714898-3022743489-1001\...\Policies\Explorer: [NolowDiskSpaceChecks] 1 ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File GroupPolicy: Restriction <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-3779877807-738714898-3022743489-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3779877807-738714898-3022743489-1001 -> {85A60A59-D3D8-468F-B598-FB4393789EF4} URL = hxxps://www.google.de/search?q={searchTerms} StartMenuInternet: IEXPLORE.EXE - iexplore.exe FF ProfilePath: C:\Users\NoCanDo\AppData\Roaming\Mozilla\Firefox\Profiles\all4o6rp.default-1486584292368 [2017-03-19] FF user.js: detected! => C:\Users\NoCanDo\AppData\Roaming\Mozilla\Firefox\Profiles\all4o6rp.default-1486584292368\user.js [2017-03-18] FF NewTab: Mozilla\Firefox\Profiles\all4o6rp.default-1486584292368 -> about:blank FF DefaultSearchEngine: Mozilla\Firefox\Profiles\all4o6rp.default-1486584292368 -> Google FF SelectedSearchEngine: Mozilla\Firefox\Profiles\all4o6rp.default-1486584292368 -> Google S3 ibtsiva; %SystemRoot%\system32\ibtsiva [X] R0 cm_km; C:\WINDOWS\System32\DRIVERS\cm_km.sys [389816 2015-07-06] (Kaspersky Lab ZAO) S3 cpuz139; no ImagePath S3 cpuz140; no ImagePath U4 klkbdflt2; \SystemRoot\system32\DRIVERS\klkbdflt2.sys [X] S3 vmci; \SystemRoot\System32\drivers\vmci.sys [X] S3 VMnetAdapter; \SystemRoot\system32\DRIVERS\vmnetadapter.sys [X] 2017-03-18 20:33 - 2017-03-18 20:34 - 00000000 ____D C:\WINDOWS\LastGood.Tmp CMD: netsh winsock reset all CMD: ipconfig /flushdns hosts: EmptyTemp: Reboot: end ***************** Restore point was successfully created. Processes closed successfully. ========= RemoveProxy: ========= HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully HKU\S-1-5-21-3779877807-738714898-3022743489-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully HKU\S-1-5-21-3779877807-738714898-3022743489-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully ========= End of RemoveProxy: ========= HKU\S-1-5-21-3779877807-738714898-3022743489-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NolowDiskSpaceChecks => value removed successfully HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive1 => key removed successfully HKCR\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524} => key not found. HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive2 => key removed successfully HKCR\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282} => key not found. HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive3 => key removed successfully HKCR\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30} => key not found. HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive4 => key removed successfully HKCR\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A} => key not found. HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive5 => key removed successfully HKCR\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => key not found. HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive1 => key removed successfully HKCR\Wow6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524} => key not found. HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive2 => key removed successfully HKCR\Wow6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282} => key not found. HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive3 => key removed successfully HKCR\Wow6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30} => key not found. HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive4 => key removed successfully HKCR\Wow6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A} => key not found. HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive5 => key removed successfully HKCR\Wow6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => key not found. C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully C:\WINDOWS\SysWOW64\GroupPolicy\GPT.ini => moved successfully HKLM\SOFTWARE\Policies\Google => key removed successfully HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => key not found. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKU\S-1-5-21-3779877807-738714898-3022743489-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully HKU\S-1-5-21-3779877807-738714898-3022743489-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{85A60A59-D3D8-468F-B598-FB4393789EF4} => key removed successfully HKCR\CLSID\{85A60A59-D3D8-468F-B598-FB4393789EF4} => key not found. HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => value restored successfully C:\Users\NoCanDo\AppData\Roaming\Mozilla\Firefox\Profiles\all4o6rp.default-1486584292368 => moved successfully C:\Users\NoCanDo\AppData\Roaming\Mozilla\Firefox\Profiles\all4o6rp.default-1486584292368 => path removed successfully C:\Users\NoCanDo\AppData\Roaming\Mozilla\Firefox\Profiles\all4o6rp.default-1486584292368\user.js => not found. C:\Users\NoCanDo\AppData\Roaming\Mozilla\Firefox\Profiles\all4o6rp.default-1486584292368\user.js => not found. FF NewTab: Mozilla\Firefox\Profiles\all4o6rp.default-1486584292368 -> about:blank => not found FF DefaultSearchEngine: Mozilla\Firefox\Profiles\all4o6rp.default-1486584292368 -> Google => not found FF SelectedSearchEngine: Mozilla\Firefox\Profiles\all4o6rp.default-1486584292368 -> Google => not found HKLM\System\CurrentControlSet\Services\ibtsiva => key removed successfully ibtsiva => service removed successfully cm_km => Unable to stop service. HKLM\System\CurrentControlSet\Services\cm_km => key could not remove, key could be protected HKLM\System\CurrentControlSet\Services\cpuz139 => key removed successfully cpuz139 => service removed successfully HKLM\System\CurrentControlSet\Services\cpuz140 => key removed successfully cpuz140 => service removed successfully HKLM\System\CurrentControlSet\Services\klkbdflt2 => key could not remove, key could be protected HKLM\System\CurrentControlSet\Services\vmci => key removed successfully vmci => service removed successfully HKLM\System\CurrentControlSet\Services\VMnetAdapter => key removed successfully VMnetAdapter => service removed successfully C:\WINDOWS\LastGood.Tmp => moved successfully ========= netsh winsock reset all ========= Sucessfully reset the Winsock Catalog. You must restart the computer in order to complete the reset. ========= End of CMD: ========= ========= ipconfig /flushdns ========= Windows IP Configuration Successfully flushed the DNS Resolver Cache. ========= End of CMD: ========= C:\Windows\System32\Drivers\etc\hosts => moved successfully Hosts restored successfully. =========== EmptyTemp: ========== BITS transfer queue => 0 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 163518136 B Java, Flash, Steam htmlcache => 13970719 B Windows/system/drivers => 8777464 B Edge => 397 B Chrome => 96261367 B Firefox => 13174849 B Opera => 0 B Temp, IE cache, history, cookies, recent: Default => 0 B Users => 0 B ProgramData => 0 B Public => 0 B systemprofile => 128 B systemprofile32 => 128 B LocalService => 11482 B NetworkService => 0 B NoCanDo => 752731 B RecycleBin => 0 B EmptyTemp: => 282.7 MB temporary data Removed. ================================ Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 19-03-2017 21:30:51) Result of scheduled keys to remove after reboot: HKLM\System\CurrentControlSet\Services\cm_km => key could not remove, key could be protected HKLM\System\CurrentControlSet\Services\klkbdflt2 => key could not remove, key could be protected ==== End of Fixlog 21:30:53 ====