Fix result of Farbar Recovery Scan Tool (x64) Version: 18-06-2017 01 Ran by sgfra (21-06-2017 09:33:03) Run:1 Running from C:\Users\sgfra\Desktop Loaded Profiles: sgfra (Available Profiles: sgfra) Boot Mode: Normal ============================================== fixlist content: ***************** CreateRestorePoint: CloseProcesses: EmptyTemp: Hosts: ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File ShellIconOverlayIdentifiers: [JzShlobj] -> {9A0700D2-920A-4E52-8697-9B5230C92612} => -> No File ShellIconOverlayIdentifiers: [KzShlobj] -> {AAA0C5B8-933F-4200-93AD-B143D7FFF9F2} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File URLSearchHook: [S-1-5-21-2398247234-322909077-3554112957-1001] ATTENTION => Default URLSearchHook is missing SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-2398247234-322909077-3554112957-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = Handler: WSWSVCUchrome - {1CA93FF0-A218-44F1 - No File S3 catchme; \??\C:\Users\sgfra\AppData\Local\Temp\catchme.sys [X] <==== ATTENTION S3 dbx; system32\DRIVERS\dbx.sys [X] U0 Partizan; system32\drivers\Partizan.sys [X] 2017-06-08 08:47 - 2017-03-13 19:14 - 00000000 ____D C:\ProgramData\IObit 2017-06-08 08:47 - 2017-03-13 19:14 - 00000000 ____D C:\Program Files (x86)\IObit 2017-06-19 17:24 - 2017-06-19 17:24 - 13460656 _____ (Reimage) C:\Users\sgfra\AppData\Local\Temp\ReimagePackage.exe Task: {00876289-58F7-4155-906D-FEE5F1FE1449} - \Driver Robot -> No File Task: {8C31723D-314F-4E18-A9E2-A5A143F7337A} - \Microsoft\Windows\MemoryDiagnostic\VideoMemoryDiagnostic -> No File ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxps://launchpage.org/?uid=oTlKGKjdhx1sXu9WsoYn%2BrpWc5o8l8blIijs6ImBj3wt%2FmM41cDo3Sv7MTRoca8rKQ%3D%3D AlternateDataStreams: C:\ProgramData\TEMP:15D5AA51 [370] AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [125] C:\Users\sgfra\AppData\Roaming\ZHP\Quarantine\Chatango\Chatango Message Catcher.lnk C:\Users\sgfra\AppData\Roaming\ZHP\Quarantine\Chatango\Uninstall.lnkcmd: ipconfig /flushdns CMD: WHERE /r c:\ keyge*.* /t cmd: dism.exe /online /cleanup-image /restorehealth cmd: sfc /scannow cmd: chkdsk c: /F /R cmd: netsh winsock reset ***************** Restore point was successfully created. Processes closed successfully. Hosts restored successfully. HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive1 => key removed successfully HKLM\Software\Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524} => key not found. HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive2 => key removed successfully HKLM\Software\Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282} => key not found. HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive3 => key removed successfully HKLM\Software\Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30} => key not found. HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive4 => key removed successfully HKLM\Software\Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A} => key not found. HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive5 => key removed successfully HKLM\Software\Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => key not found. HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\JzShlobj => key removed successfully HKLM\Software\Classes\CLSID\{9A0700D2-920A-4E52-8697-9B5230C92612} => key not found. HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\KzShlobj => key removed successfully HKLM\Software\Classes\CLSID\{AAA0C5B8-933F-4200-93AD-B143D7FFF9F2} => key not found. HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive1 => key removed successfully HKLM\Software\Wow6432Node\Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524} => key not found. HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive2 => key removed successfully HKLM\Software\Wow6432Node\Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282} => key not found. HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive3 => key removed successfully HKLM\Software\Wow6432Node\Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30} => key not found. HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive4 => key removed successfully HKLM\Software\Wow6432Node\Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A} => key not found. HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive5 => key removed successfully HKLM\Software\Wow6432Node\Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => key not found. Could not restore Default URLSearchHook. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully HKU\S-1-5-21-2398247234-322909077-3554112957-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully HKLM\Software\Classes\PROTOCOLS\Handler\WSWSVCUchrome => key removed successfully HKLM\System\CurrentControlSet\Services\catchme => key removed successfully catchme => service removed successfully HKLM\System\CurrentControlSet\Services\dbx => key removed successfully dbx => service removed successfully HKLM\System\CurrentControlSet\Services\Partizan => key removed successfully Partizan => service removed successfully C:\ProgramData\IObit => moved successfully C:\Program Files (x86)\IObit => moved successfully "C:\Users\sgfra\AppData\Local\Temp\ReimagePackage.exe" => not found.