Fix result of Farbar Recovery Scan Tool (x64) Version: 22-12-2019 Ran by Jordi (24-12-2019 10:28:09) Run:1 Running from C:\Users\Jordi\Desktop Loaded Profiles: Jordi (Available Profiles: Jordi) Boot Mode: Normal ============================================== fixlist content: ***************** Start CloseProcesses: CreateRestorePoint: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION HKU\S-1-5-21-2386650303-937493529-1628659523-1001\...\MountPoints2: {9c6a3cdc-b600-11e8-a9d2-bc5ff4202a67} - "I:\Autorun.exe" HKU\S-1-5-21-2386650303-937493529-1628659523-1001\...\MountPoints2: {ca838e5b-b437-11e9-aab7-9d87e92199ff} - "D:\setup_vmc_lite.exe" /checkApplicationPresence GroupPolicy: Restriction ? <==== ATTENTION Task: {5EFB72E1-A993-47A9-BFB7-DADB97975864} - System32\Tasks\EOSv3 Scheduler onTime => C:\Users\Jordi\Downloads\esetonlinescanner_esn.exe [8162616 2019-12-20] (ESET, spol. s r.o. -> ESET spol. s r.o.) Task: {C8D513CE-DA0C-40D2-884F-D594632E651B} - System32\Tasks\HardDiskSentinel\Hard Disk Sentinel_Jordi => C:\Program Files (x86)\Hard Disk Sentinel\HDSentinel.exe [5445120 2018-07-17] (H.D.S. Hungary) [File not signed] Task: {DB9B2E6F-7F08-4B34-8685-B07C2AFB07D1} - System32\Tasks\EOSv3 Scheduler onLogOn => C:\Users\Jordi\Downloads\esetonlinescanner_esn.exe [8162616 2019-12-20] (ESET, spol. s r.o. -> ESET spol. s r.o.) S3 ekrnEpfw; C:\Program Files\ESET\ESET Security\ekrn.exe [2330224 2018-07-12] (ESET, spol. s r.o. -> ESET) R2 PaceLicenseDServices; "C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe" -u https://activation.paceap.com/InitiateActivation [X] 2019-12-20 22:34 - 2019-12-22 00:45 - 000000000 ____D C:\KVRT_Data 2019-12-20 22:34 - 2019-12-20 22:34 - 179094968 _____ (AO Kaspersky Lab) C:\Users\Jordi\Downloads\KVRT.exe 2019-12-20 08:31 - 2019-12-20 08:31 - 008162616 _____ (ESET spol. s r.o.) C:\Users\Jordi\Downloads\esetonlinescanner_esn.exe 2019-12-20 08:31 - 2019-12-20 08:31 - 000000769 _____ C:\Users\Jordi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk 2019-12-20 08:31 - 2019-12-20 08:31 - 000000670 _____ C:\Users\Jordi\Desktop\ESET Online Scanner.lnk 2019-12-18 00:49 - 2019-12-18 00:56 - 000000000 ____D C:\ProgramData\RogueKiller 2019-12-18 00:49 - 2019-12-18 00:49 - 037028920 _____ C:\Users\Jordi\Downloads\RogueKiller_portable64.exe 2019-12-18 00:16 - 2019-12-18 00:17 - 002953520 _____ (AVAST Software) C:\Users\Jordi\Downloads\avast-browser-cleanup.exe 2019-12-04 17:43 - 2019-12-04 17:43 - 000011101 _____ C:\Users\Jordi\Downloads\ge27877.mid ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => -> No File ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} => -> No File ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File AlternateDataStreams: C:\ProgramData\Config32:D_Time [5] AlternateDataStreams: C:\ProgramData\Config32:reg [47] CMD: ipconfig /flushdns CMD: ipconfig /renew CMD: bitsadmin /reset /allusers CMD: netsh winsock reset CMD: netsh advfirewall reset CMD: netsh advfirewall set allprofiles state ON CMD: netsh int ipv4 reset CMD: netsh int ipv6 reset RemoveProxy: EmptyTemp: Hosts: END ***************** Processes closed successfully. Restore point was successfully created. HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => removed successfully HKU\S-1-5-21-2386650303-937493529-1628659523-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9c6a3cdc-b600-11e8-a9d2-bc5ff4202a67} => removed successfully HKU\S-1-5-21-2386650303-937493529-1628659523-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ca838e5b-b437-11e9-aab7-9d87e92199ff} => removed successfully C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5EFB72E1-A993-47A9-BFB7-DADB97975864}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5EFB72E1-A993-47A9-BFB7-DADB97975864}" => removed successfully C:\WINDOWS\System32\Tasks\EOSv3 Scheduler onTime => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\EOSv3 Scheduler onTime" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{C8D513CE-DA0C-40D2-884F-D594632E651B}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C8D513CE-DA0C-40D2-884F-D594632E651B}" => removed successfully C:\WINDOWS\System32\Tasks\HardDiskSentinel\Hard Disk Sentinel_Jordi => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\HardDiskSentinel\Hard Disk Sentinel_Jordi" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{DB9B2E6F-7F08-4B34-8685-B07C2AFB07D1}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DB9B2E6F-7F08-4B34-8685-B07C2AFB07D1}" => removed successfully C:\WINDOWS\System32\Tasks\EOSv3 Scheduler onLogOn => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\EOSv3 Scheduler onLogOn" => removed successfully HKLM\System\CurrentControlSet\Services\ekrnEpfw => removed successfully ekrnEpfw => service removed successfully PaceLicenseDServices => Unable to stop service. HKLM\System\CurrentControlSet\Services\PaceLicenseDServices => removed successfully PaceLicenseDServices => service removed successfully C:\KVRT_Data => moved successfully C:\Users\Jordi\Downloads\KVRT.exe => moved successfully C:\Users\Jordi\Downloads\esetonlinescanner_esn.exe => moved successfully C:\Users\Jordi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk => moved successfully C:\Users\Jordi\Desktop\ESET Online Scanner.lnk => moved successfully C:\ProgramData\RogueKiller => moved successfully C:\Users\Jordi\Downloads\RogueKiller_portable64.exe => moved successfully C:\Users\Jordi\Downloads\avast-browser-cleanup.exe => moved successfully C:\Users\Jordi\Downloads\ge27877.mid => moved successfully HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\ANotepad++64 => removed successfully HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\BriefcaseMenu => removed successfully "HKLM\Software\Classes\CLSID\{85BBD920-42A0-1069-A2E4-08002B30309D}" => removed successfully HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers\{4A7C4306-57E0-4C0C-83A9-78C1528F618C} => removed successfully HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\BriefcaseMenu => removed successfully C:\ProgramData\Config32 => ":D_Time" ADS removed successfully C:\ProgramData\Config32 => ":reg" ADS removed successfully ========= ipconfig /flushdns ========= Configuraci¢n IP de Windows Se vaci¢ correctamente la cach‚ de resoluci¢n de DNS. ========= End of CMD: ========= ========= ipconfig /renew ========= Configuraci¢n IP de Windows No se puede realizar ninguna operaci¢n en Conexi¢n de  rea local* 2 mientras los medios est‚n desconectados. No se puede realizar ninguna operaci¢n en Conexi¢n de  rea local* 3 mientras los medios est‚n desconectados. Adaptador de LAN inal mbrica Conexi¢n de  rea local* 2: Estado de los medios. . . . . . . . . . . : medios desconectados Sufijo DNS espec¡fico para la conexi¢n. . : Adaptador de LAN inal mbrica Conexi¢n de  rea local* 3: Estado de los medios. . . . . . . . . . . : medios desconectados Sufijo DNS espec¡fico para la conexi¢n. . : Adaptador de LAN inal mbrica Wi-Fi: Sufijo DNS espec¡fico para la conexi¢n. . : V¡nculo: direcci¢n IPv6 local. . . : fe80::bd67:83d1:be76:75ba%6 Direcci¢n IPv4. . . . . . . . . . . . . . : 192.168.0.14 M scara de subred . . . . . . . . . . . . : 255.255.255.0 Puerta de enlace predeterminada . . . . . : 192.168.0.1 ========= End of CMD: ========= ========= bitsadmin /reset /allusers ========= BITSADMIN version 3.0 BITS administration utility. (C) Copyright Microsoft Corp. 0 out of 0 jobs canceled. ========= End of CMD: ========= ========= netsh winsock reset ========= El cat logo Winsock se restableci¢ correctamente. Debe reiniciar el equipo para completar el restablecimiento. ========= End of CMD: ========= ========= netsh advfirewall reset ========= Aceptar ========= End of CMD: ========= ========= netsh advfirewall set allprofiles state ON ========= Aceptar ========= End of CMD: ========= ========= netsh int ipv4 reset ========= Reenv¡o de compartimiento se restableci¢ correctamente. Compartimiento se restableci¢ correctamente. Protocolo de control se restableci¢ correctamente. Solicitud de secuencia eco se restableci¢ correctamente. Global se restableci¢ correctamente. Interfaz se restableci¢ correctamente. Direcci¢n de difusi¢n por proximidad (a se restableci¢ correctamente. Direcciones de multidifusi¢n se restableci¢ correctamente. Direcci¢n de unidifusi¢n se restableci¢ correctamente. Vecino se restableci¢ correctamente. Ruta de acceso se restableci¢ correctamente. Posible se restableci¢ correctamente. Directiva de prefijo se restableci¢ correctamente. Vecino de proxy se restableci¢ correctamente. Ruta se restableci¢ correctamente. Prefijo de sitio se restableci¢ correctamente. Subinterfaz se restableci¢ correctamente. Patr¢n de reactivaci¢n se restableci¢ correctamente. Resolver vecino se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. Error al restablecer . Acceso denegado. se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. Reinicie el equipo para completar esta acci¢n. ========= End of CMD: ========= ========= netsh int ipv6 reset ========= Reenv¡o de compartimiento se restableci¢ correctamente. Compartimiento se restableci¢ correctamente. Protocolo de control se restableci¢ correctamente. Solicitud de secuencia eco se restableci¢ correctamente. Global se restableci¢ correctamente. Interfaz se restableci¢ correctamente. Direcci¢n de difusi¢n por proximidad (a se restableci¢ correctamente. Direcciones de multidifusi¢n se restableci¢ correctamente. Direcci¢n de unidifusi¢n se restableci¢ correctamente. Vecino se restableci¢ correctamente. Ruta de acceso se restableci¢ correctamente. Posible se restableci¢ correctamente. Directiva de prefijo se restableci¢ correctamente. Vecino de proxy se restableci¢ correctamente. Ruta se restableci¢ correctamente. Prefijo de sitio se restableci¢ correctamente. Subinterfaz se restableci¢ correctamente. Patr¢n de reactivaci¢n se restableci¢ correctamente. Resolver vecino se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. Error al restablecer . Acceso denegado. se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. se restableci¢ correctamente. Reinicie el equipo para completar esta acci¢n. ========= End of CMD: ========= ========= RemoveProxy: ========= "HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully "HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully "HKU\S-1-5-21-2386650303-937493529-1628659523-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully "HKU\S-1-5-21-2386650303-937493529-1628659523-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully ========= End of RemoveProxy: ========= C:\Windows\System32\Drivers\etc\hosts => moved successfully Hosts restored successfully. =========== EmptyTemp: ========== BITS transfer queue => 10510336 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 465826264 B Java, Flash, Steam htmlcache => 67625109 B Windows/system/drivers => 3273583 B Edge => 11381 B Chrome => 143459 B Firefox => 216923986 B Opera => 0 B Temp, IE cache, history, cookies, recent: Default => 0 B Users => 0 B ProgramData => 0 B Public => 0 B systemprofile => 0 B systemprofile32 => 0 B LocalService => 10012 B NetworkService => 10012 B Jordi => 7306355 B RecycleBin => 14788 B EmptyTemp: => 735.9 MB temporary data Removed. ================================ The system needed a reboot. ==== End of Fixlog 10:28:44 ====