Fix result of Farbar Recovery Scan Tool (x64) Version: 16-11-2016 Ran by [removed] (19-11-2016 15:09:08) Run:1 Running from C:\Users\[removed]\Downloads [removed] Boot Mode: Normal ============================================== fixlist content: ***************** CreateRestorePoint: HKLM\...\Run: [up] => wscript.exe //B "C:\Users\JOHN\AppData\Local\Temp\up.vbs" <===== ATTENTION HKLM-x32\...\Run: [up] => wscript.exe //B "C:\Users\JOHN\AppData\Local\Temp\up.vbs" <===== ATTENTION HKU\S-1-5-21-3634378098-2526221181-1815557863-1001\...\Run: [up] => wscript.exe //B "C:\Users\JOHN\AppData\Local\Temp\up.vbs" <===== ATTENTION HKU\S-1-5-21-3634378098-2526221181-1815557863-1001\...\Run: [x11] => wscript.exe //B "C:\Users\JOHN\AppData\Local\Temp\x11.vbs" <===== ATTENTION HKU\S-1-5-21-3634378098-2526221181-1815557863-1001\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File Startup: C:\Users\JOHN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\up.vbs [2016-01-14] () Startup: C:\Users\JOHN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x11.vbs [2016-11-14] () BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll [2009-01-26] (Safer Networking Limited) HKU\S-1-5-21-3634378098-2526221181-1815557863-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.officialcerts.com CHR HKU\S-1-5-21-3634378098-2526221181-1815557863-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx Task: {0B1B0048-6823-4826-8CE7-8DED040FA6E6} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION Task: {17314671-B9A7-4A45-8307-126F5C013ACD} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION Task: {227ABF02-6587-4A09-8472-C1B4643EAB83} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION Task: {6DF39014-EF99-4995-9C33-E406E70AE35D} - \McAfee\McAfee Idle Detection Task -> No File <==== ATTENTION Task: {7FD70A5C-5653-4502-A6CC-9EDC689BCF4C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION Task: {D47D7F47-79C9-4573-B9D9-9AC9D95FC6C1} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION Task: {D47D7F47-79C9-4573-B9D9-9AC9D95FC6C1} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION C:\Users\JOHN\AppData\Local\Temp\z1.exe Folder: C:\Users\JOHN\AppData\Local\Temp\ocr71DD.tmp Folder: C:\Users\JOHN\AppData\Local\Temp\ocrBC63.tmp Hosts: EmptyTemp: CMD: ipconfig /flushdns ***************** Restore point was successfully created. HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\up => value removed successfully HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\up => value removed successfully HKU\S-1-5-21-3634378098-2526221181-1815557863-1001\Software\Microsoft\Windows\CurrentVersion\Run\\up => value removed successfully HKU\S-1-5-21-3634378098-2526221181-1815557863-1001\Software\Microsoft\Windows\CurrentVersion\Run\\x11 => value removed successfully HKU\S-1-5-21-3634378098-2526221181-1815557863-1001\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer => value not found. "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast" => key removed successfully HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found. C:\Users\JOHN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\up.vbs => moved successfully C:\Users\JOHN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x11.vbs => moved successfully HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F} => key not found. HKCR\Wow6432Node\CLSID\{53707962-6F74-2D53-2644-206D7942484F} => key not found. HKU\S-1-5-21-3634378098-2526221181-1815557863-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully "HKU\S-1-5-21-3634378098-2526221181-1815557863-1001\SOFTWARE\Google\Chrome\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0B1B0048-6823-4826-8CE7-8DED040FA6E6}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0B1B0048-6823-4826-8CE7-8DED040FA6E6}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{17314671-B9A7-4A45-8307-126F5C013ACD}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{17314671-B9A7-4A45-8307-126F5C013ACD}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{227ABF02-6587-4A09-8472-C1B4643EAB83}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{227ABF02-6587-4A09-8472-C1B4643EAB83}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6DF39014-EF99-4995-9C33-E406E70AE35D}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6DF39014-EF99-4995-9C33-E406E70AE35D}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\McAfee\McAfee Idle Detection Task" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7FD70A5C-5653-4502-A6CC-9EDC689BCF4C}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7FD70A5C-5653-4502-A6CC-9EDC689BCF4C}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D47D7F47-79C9-4573-B9D9-9AC9D95FC6C1}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D47D7F47-79C9-4573-B9D9-9AC9D95FC6C1}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => key removed successfully HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D47D7F47-79C9-4573-B9D9-9AC9D95FC6C1} => key not found. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess => key not found. C:\Users\JOHN\AppData\Local\Temp\z1.exe => moved successfully ========================= Folder: C:\Users\JOHN\AppData\Local\Temp\ocr71DD.tmp ======================== not found. ====== End of Folder: ====== ========================= Folder: C:\Users\JOHN\AppData\Local\Temp\ocrBC63.tmp ======================== not found. ====== End of Folder: ====== C:\Windows\System32\Drivers\etc\hosts => moved successfully Hosts restored successfully. ========= ipconfig /flushdns ========= Windows IP Configuration Successfully flushed the DNS Resolver Cache. ========= End of CMD: ========= =========== EmptyTemp: ========== BITS transfer queue => 0 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 35191837 B Java, Flash, Steam htmlcache => 1145 B Windows/system/drivers => 1929890 B Edge => 9014 B Chrome => 0 B Firefox => 533730097 B Opera => 0 B Temp, IE cache, history, cookies, recent: Default => 6656 B ProgramData => 0 B Public => 0 B systemprofile => 0 B systemprofile32 => 0 B LocalService => 1687500 B NetworkService => 0 B JOHN => 62261250 B RecycleBin => 0 B EmptyTemp: => 605.4 MB temporary data Removed. ================================ The system needed a reboot. ==== End of Fixlog 15:11:11 ====