Fix result of Farbar Recovery Scan Tool (x64) Version: 31-08-2016 Ran by anhthe (11-09-2016 11:46:13) Run:1 Running from D:\Download\Programs Loaded Profiles: anhthe (Available Profiles: anhthe) Boot Mode: Normal ============================================== fixlist content: ***************** CloseProcesses: HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\...\MountPoints2: {b4d2f8c5-2e77-11e6-9bf2-185e0f7a7e51} - "F:\startme.exe" Tcpip\..\Interfaces\{61c73488-1340-4778-8329-7eb4dd6dbea1}: [NameServer] 188.120.239.115,8.8.8.8 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://its-neu.com R1 UCGuard; C:\Windows\System32\DRIVERS\ucguard.sys [81792 2016-08-02] (Huorong Borui (Beijing) Technology Co., Ltd.) Task: {A99A1F19-9484-4552-8E3B-44672C621EC1} - System32\Tasks\UCBrowserUpdater => C:\Program Files (x86)\UCBrowser\Application\update_task.exe Task: C:\WINDOWS\Tasks\UCBrowserUpdater.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe C:\WINDOWS\system32\Drivers\ucguard.sys C:\WINDOWS\Tasks\UCBrowserUpdater.job C:\WINDOWS\System32\Tasks\UCBrowserUpdater C:\Program Files (x86)\sbqh C:\Program Files (x86)\uvzE4A3 C:\gnbotpokestat C:\gnbotpokelog C:\gnbotpokectrl C:\gnbotpoke reboot: ***************** Processes closed successfully. "HKU\S-1-5-21-1483297329-2720066829-2040343632-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b4d2f8c5-2e77-11e6-9bf2-185e0f7a7e51}" => key removed successfully HKCR\CLSID\{b4d2f8c5-2e77-11e6-9bf2-185e0f7a7e51} => key not found. HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{61c73488-1340-4778-8329-7eb4dd6dbea1}\\NameServer => value removed successfully HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully UCGuard => Unable to stop service. UCGuard => service removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A99A1F19-9484-4552-8E3B-44672C621EC1}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A99A1F19-9484-4552-8E3B-44672C621EC1}" => key removed successfully C:\WINDOWS\System32\Tasks\UCBrowserUpdater => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\UCBrowserUpdater" => key removed successfully C:\WINDOWS\Tasks\UCBrowserUpdater.job => moved successfully C:\WINDOWS\system32\Drivers\ucguard.sys => moved successfully "C:\WINDOWS\Tasks\UCBrowserUpdater.job" => not found. "C:\WINDOWS\System32\Tasks\UCBrowserUpdater" => not found. C:\Program Files (x86)\sbqh => moved successfully C:\Program Files (x86)\uvzE4A3 => moved successfully C:\gnbotpokestat => moved successfully C:\gnbotpokelog => moved successfully C:\gnbotpokectrl => moved successfully C:\gnbotpoke => moved successfully The system needed a reboot. ==== End of Fixlog 11:46:20 ====